6ca11c8b6442db97c02f3b0f73db61f58c96d52e8a880e33abee5b10807d993f

Analysis

max time kernel
888s
max time network
461s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 18:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ADZP 20 Complex.exe
Size 106KB
Sample240526-w92dpsff8t
SHA256 6ca11c8b6442db97c02f3b0f73db61f58c96d52e8a880e33abee5b10807d993f
MD5 8b6a377f9a67d5482a8eba5708f45bb2
SHA1 7197436525e568606850ee5e033c43aea1c3bc91
SHA512 644e51798399168530b05e629b414dd80cac678bd3c8d4a5d164f55736a2b2fd380d3ca4640f7a034c8f043c06b1527b473e2d17da088d5e97de6ea04120dd72
SSDEEP 3072:v7DhdC6kzWypvaQ0FxyNTBfqMXERseQF8:vBlkZvaF4NTBSAesPF8
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery evasion exploit persistence spyware stealer

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 25 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
5456	netsh.exe
3120	netsh.exe
14800	netsh.exe
5760	netsh.exe
1660	netsh.exe
8180	netsh.exe
15284	netsh.exe
15608	netsh.exe
9796	netsh.exe
2052	netsh.exe
5852	netsh.exe
2448	netsh.exe
11964	netsh.exe
7380	netsh.exe
15884	netsh.exe
15932	netsh.exe
8812	netsh.exe
5696	netsh.exe
16020	netsh.exe
3180	netsh.exe
10364	netsh.exe
7876	netsh.exe
12536	netsh.exe
9196	netsh.exe
9732	netsh.exe

Possible privilege escalation attempt 24 IoCs

exploit

pid	Process
9936	takeown.exe
5888	takeown.exe
6004	takeown.exe
7336	takeown.exe
4252	takeown.exe
12484	takeown.exe
2392	takeown.exe
15688	takeown.exe
9548	takeown.exe
7128	takeown.exe
8536	takeown.exe
364	takeown.exe
13884	takeown.exe
2944	takeown.exe
15280	takeown.exe
13940	takeown.exe
6112	takeown.exe
6052	takeown.exe
636	takeown.exe
13432	icacls.exe
8944	takeown.exe
10888	takeown.exe
6324	takeown.exe
6028	takeown.exe

Checks computer location settings 2 TTPs 26 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	cmd.exe

Executes dropped EXE 48 IoCs

pid	Process
2152	ADZP 20 Complex.exe
1012	ADZP 20 Complex.exe
1824	ADZP 20 Complex.exe
6032	Twain_20.dll
5872	ADZP 20 Complex.exe
6236	ADZP 20 Complex.exe
6580	ADZP 20 Complex.exe
6884	ADZP 20 Complex.exe
3608	ADZP 20 Complex.exe
6552	ADZP 20 Complex.exe
8220	Twain_20.dll
8828	Twain_20.dll
8520	Twain_20.dll
9800	ADZP 20 Complex.exe
10028	Twain_20.dll
8252	ADZP 20 Complex.exe
4752	ADZP 20 Complex.exe
1620	ADZP 20 Complex.exe
7556	ADZP 20 Complex.exe
11308	ADZP 20 Complex.exe
11704	ADZP 20 Complex.exe
11888	ADZP 20 Complex.exe
5988	ADZP 20 Complex.exe
11968	ADZP 20 Complex.exe
12916	ADZP 20 Complex.exe
12344	ADZP 20 Complex.exe
11912	Twain_20.dll
8596	Twain_20.dll
1000	ADZP 20 Complex.exe
4264	ADZP 20 Complex.exe
11732	ADZP 20 Complex.exe
5800	ADZP 20 Complex.exe
14504	ADZP 20 Complex.exe
6980	ADZP 20 Complex.exe
10844	ADZP 20 Complex.exe
8212	ADZP 20 Complex.exe
11484	ADZP 20 Complex.exe
7460	ADZP 20 Complex.exe
11804	ADZP 20 Complex.exe
16036	ADZP 20 Complex.exe
8912	ADZP 20 Complex.exe
11832	ADZP 20 Complex.exe
4160	ADZP 20 Complex.exe
4592	ADZP 20 Complex.exe
13020	ADZP 20 Complex.exe
13700	ADZP 20 Complex.exe
5416	ADZP 20 Complex.exe
12388	ADZP 20 Complex.exe

Modifies file permissions 1 TTPs 24 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
8536	takeown.exe
2944	takeown.exe
6052	takeown.exe
4252	takeown.exe
6028	takeown.exe
9548	takeown.exe
9936	takeown.exe
10888	takeown.exe
6324	takeown.exe
636	takeown.exe
6004	takeown.exe
13940	takeown.exe
15688	takeown.exe
15280	takeown.exe
5888	takeown.exe
7128	takeown.exe
8944	takeown.exe
364	takeown.exe
13884	takeown.exe
12484	takeown.exe
13432	icacls.exe
2392	takeown.exe
7336	takeown.exe
6112	takeown.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Twain_20 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Twain_20.cmd"	reg.exe

Drops autorun.inf file 1 TTPs 57 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\Autorun.inf	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\Autorun.inf	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\Autorun.inf	attrib.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\Autorun.inf	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\Autorun.inf	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\Autorun.inf	attrib.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\Autorun.inf	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\Autorun.inf	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\Autorun.inf	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\Autorun.inf	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\Autorun.inf	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\Autorun.inf	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\Autorun.inf	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\Autorun.inf	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\Autorun.inf	attrib.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\Autorun.inf	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\Autorun.inf	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\Autorun.inf	attrib.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\Autorun.inf	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\Autorun.inf	attrib.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\Autorun.inf	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\Autorun.inf	attrib.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\Autorun.inf	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\Autorun.inf	attrib.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\Autorun.inf	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\Autorun.inf	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\Autorun.inf	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\Autorun.inf	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\Autorun.inf	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\Autorun.inf	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\Autorun.inf	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\Autorun.inf	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\Autorun.inf	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\Autorun.inf	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\Autorun.inf	attrib.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\Autorun.inf	attrib.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\Autorun.inf	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\Autorun.inf	attrib.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\Autorun.inf	attrib.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\Autorun.inf	attrib.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\Autorun.inf	attrib.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\Autorun.inf	attrib.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\Autorun.inf	attrib.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\Autorun.inf	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\Autorun.inf	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\Autorun.inf	attrib.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\Autorun.inf	attrib.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\Autorun.inf	attrib.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\Autorun.inf	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\Autorun.inf	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\Autorun.inf	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\Autorun.inf	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\Autorun.inf	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\Autorun.inf	attrib.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\Autorun.inf	attrib.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\Autorun.inf	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\Autorun.inf	attrib.exe

Drops file in System32 directory 61 IoCs

description	ioc	Process
File created	C:\Windows\System32\Twain_20.dll	cmd.exe
File opened for modification	C:\Windows\System32\Twain_20.dll	cmd.exe
File opened for modification	C:\Windows\System32\Twain_20.dll	cmd.exe
File opened for modification	C:\Windows\System32\Twain_20.dll	cmd.exe
File opened for modification	C:\Windows\System32\Twain_20.dll	cmd.exe
File opened for modification	C:\Windows\System32\Twain_20.dll	cmd.exe
File created	C:\Windows\System32\Twain_20.dll	cmd.exe
File created	C:\Windows\System32\Twain_20.dll	cmd.exe
File opened for modification	C:\Windows\System32\Twain_20.dll	cmd.exe
File opened for modification	C:\Windows\System32\Twain_20.dll	cmd.exe
File opened for modification	C:\Windows\System32\Twain_20.dll	cmd.exe
File created	C:\Windows\System32\Twain_20.dll	cmd.exe
File created	C:\Windows\System32\Twain_20.dll	cmd.exe
File created	C:\Windows\System32\Twain_20.dll	cmd.exe
File created	C:\Windows\System32\Twain_20.dll	cmd.exe
File opened for modification	C:\Windows\System32\Twain_20.dll	cmd.exe
File opened for modification	C:\Windows\System32\Twain_20.dll	cmd.exe
File created	C:\Windows\System32\Twain_20.dll	cmd.exe
File opened for modification	C:\Windows\System32\Twain_20.dll	cmd.exe
File opened for modification	C:\Windows\System32\Twain_20.dll	cmd.exe
File created	C:\Windows\System32\Twain_20.dll	cmd.exe
File created	C:\Windows\System32\Twain_20.dll	cmd.exe
File opened for modification	C:\Windows\System32\Twain_20.dll	cmd.exe
File created	C:\Windows\System32\Twain_20.dll	cmd.exe
File opened for modification	C:\Windows\System32\Twain_20.dll	cmd.exe
File opened for modification	C:\Windows\System32\Twain_20.dll	cmd.exe
File created	C:\Windows\System32\Twain_20.dll	cmd.exe
File created	C:\Windows\System32\Twain_20.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\Twain_20.dll	cmd.exe
File opened for modification	C:\Windows\System32\Twain_20.dll	cmd.exe
File opened for modification	C:\Windows\System32\Twain_20.dll	cmd.exe
File opened for modification	C:\Windows\System32\Twain_20.dll	cmd.exe
File created	C:\Windows\System32\Twain_20.dll	cmd.exe
File opened for modification	C:\Windows\System32\Twain_20.dll	cmd.exe
File opened for modification	C:\Windows\System32\Twain_20.dll	cmd.exe
File created	C:\Windows\System32\Twain_20.dll	cmd.exe
File created	C:\Windows\System32\Twain_20.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\Twain_20.dll	cmd.exe
File opened for modification	C:\Windows\System32\Twain_20.dll	cmd.exe
File created	C:\Windows\System32\Twain_20.dll	cmd.exe
File opened for modification	C:\Windows\System32\Twain_20.dll	cmd.exe
File opened for modification	C:\Windows\System32\Twain_20.dll	cmd.exe
File opened for modification	C:\Windows\System32\Twain_20.dll	cmd.exe
File created	C:\Windows\System32\Twain_20.dll	cmd.exe
File created	C:\Windows\System32\Twain_20.dll	cmd.exe
File created	C:\Windows\System32\Twain_20.dll	cmd.exe
File opened for modification	C:\Windows\System32\Twain_20.dll	cmd.exe
File created	C:\Windows\System32\Twain_20.dll	cmd.exe
File created	C:\Windows\System32\Twain_20.dll	cmd.exe
File created	C:\Windows\System32\Twain_20.dll	cmd.exe
File opened for modification	C:\Windows\System32\Twain_20.dll	cmd.exe
File opened for modification	C:\Windows\System32\Twain_20.dll	cmd.exe
File created	C:\Windows\System32\Twain_20.dll	cmd.exe
File created	C:\Windows\System32\Twain_20.dll	cmd.exe
File opened for modification	C:\Windows\System32\Twain_20.dll	cmd.exe
File created	C:\Windows\System32\Twain_20.dll	cmd.exe
File created	C:\Windows\System32\Twain_20.dll	cmd.exe
File opened for modification	C:\Windows\System32\Twain_20.dll	cmd.exe
File opened for modification	C:\Windows\System32\Twain_20.dll	cmd.exe
File created	C:\Windows\System32\Twain_20.dll	cmd.exe
File created	C:\Windows\SysWOW64\Twain_20.dll	cmd.exe

Drops file in Windows directory 35 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 58 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe

Enumerates system info in registry 2 TTPs 20 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Gathers network information 2 TTPs 28 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3848	ipconfig.exe
9768	ipconfig.exe
12136	ipconfig.exe
12372	ipconfig.exe
14772	ipconfig.exe
11732	ipconfig.exe
8392	ipconfig.exe
7148	ipconfig.exe
10312	ipconfig.exe
10036	ipconfig.exe
2324	ipconfig.exe
10448	ipconfig.exe
11676	ipconfig.exe
11128	ipconfig.exe
372	ipconfig.exe
8008	ipconfig.exe
16308	ipconfig.exe
13068	ipconfig.exe
4228	ipconfig.exe
6072	ipconfig.exe
6536	ipconfig.exe
10148	ipconfig.exe
4228	ipconfig.exe
9664	ipconfig.exe
14676	ipconfig.exe
10320	ipconfig.exe
8108	ipconfig.exe
5348	ipconfig.exe

Kills process with taskkill 24 IoCs

evasion

pid	Process
6512	taskkill.exe
4916	taskkill.exe
9676	taskkill.exe
14960	taskkill.exe
12316	taskkill.exe
12052	taskkill.exe
2180	taskkill.exe
4668	taskkill.exe
676	taskkill.exe
7120	taskkill.exe
9824	taskkill.exe
3264	taskkill.exe
6868	taskkill.exe
2976	taskkill.exe
6960	taskkill.exe
14832	taskkill.exe
15160	taskkill.exe
12152	taskkill.exe
8108	taskkill.exe
1996	taskkill.exe
9272	taskkill.exe
7176	taskkill.exe
11044	taskkill.exe
1360	taskkill.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings	calc.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings	calc.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings	calc.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings	calc.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings	calc.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings	calc.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings	calc.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings	calc.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings	calc.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings	calc.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings	calc.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings	calc.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings	calc.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings	calc.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings	calc.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings	calc.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings	calc.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings	calc.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings	calc.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings	calc.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings	calc.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings	calc.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2868	mspaint.exe
2868	mspaint.exe
4440	mspaint.exe
4440	mspaint.exe
1176	mspaint.exe
1176	mspaint.exe
6208	mspaint.exe
6208	mspaint.exe
6616	mspaint.exe
6616	mspaint.exe
6572	mspaint.exe
6572	mspaint.exe
7240	mspaint.exe
7240	mspaint.exe
1716	mspaint.exe
1716	mspaint.exe
6460	mspaint.exe
6460	mspaint.exe
8752	mspaint.exe
8752	mspaint.exe
6788	mspaint.exe
6788	mspaint.exe
9296	mspaint.exe
9296	mspaint.exe
10128	mspaint.exe
10128	mspaint.exe
2288	mspaint.exe
2288	mspaint.exe
5896	mspaint.exe
5896	mspaint.exe
7028	mspaint.exe
7028	mspaint.exe
11652	mspaint.exe
11652	mspaint.exe
12156	mspaint.exe
12156	mspaint.exe
11744	mspaint.exe
11744	mspaint.exe
8616	mspaint.exe
8616	mspaint.exe
12644	mspaint.exe
12644	mspaint.exe
13092	mspaint.exe
13092	mspaint.exe
8500	mspaint.exe
8500	mspaint.exe
9908	mspaint.exe
9908	mspaint.exe
13052	mspaint.exe
13052	mspaint.exe
6332	mspaint.exe
6332	mspaint.exe
8048	mspaint.exe
8048	mspaint.exe
6816	mspaint.exe
6816	mspaint.exe
15324	mspaint.exe
15324	mspaint.exe
10712	mspaint.exe
10712	mspaint.exe
12032	mspaint.exe
12032	mspaint.exe
13064	mspaint.exe
13064	mspaint.exe

Suspicious behavior: LoadsDriver 64 IoCs

pid	Process
8692	Process not Found
4844	Process not Found
14828	Process not Found
7640	Process not Found
4160	Process not Found
13592	Process not Found
5028	Process not Found
10692	Process not Found
11724	Process not Found
6740	Process not Found
12440	Process not Found
12464	Process not Found
11972	Process not Found
15232	Process not Found
5040	Process not Found
10096	Process not Found
9284	Process not Found
13536	Process not Found
11256	Process not Found
1268	Process not Found
6568	Process not Found
5980	Process not Found
740	Process not Found
15012	Process not Found
15004	Process not Found
4884	Process not Found
6708	Process not Found
14560	Process not Found
16144	Process not Found
13652	Process not Found
13076	Process not Found
14760	Process not Found
12612	Process not Found
7528	Process not Found
1708	Process not Found
15488	Process not Found
9984	Process not Found
5240	Process not Found
15972	Process not Found
9400	Process not Found
12884	Process not Found
16272	Process not Found
13928	Process not Found
12700	Process not Found
2052	Process not Found
13796	Process not Found
9620	Process not Found
1572	Process not Found
2060	Process not Found
15544	Process not Found
8824	Process not Found
7560	Process not Found
10744	Process not Found
13828	Process not Found
10668	Process not Found
9016	Process not Found
7652	Process not Found
13520	Process not Found
13752	Process not Found
12324	Process not Found
2760	Process not Found
16036	Process not Found
8632	Process not Found
13812	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2392	takeown.exe
Token: SeDebugPrivilege	676	taskkill.exe
Token: SeTakeOwnershipPrivilege	6004	takeown.exe
Token: SeDebugPrivilege	1996	taskkill.exe
Token: SeTakeOwnershipPrivilege	4252	takeown.exe
Token: SeDebugPrivilege	4916	taskkill.exe
Token: SeTakeOwnershipPrivilege	6112	takeown.exe
Token: SeDebugPrivilege	6868	taskkill.exe
Token: SeTakeOwnershipPrivilege	7128	takeown.exe
Token: SeDebugPrivilege	7120	taskkill.exe
Token: SeTakeOwnershipPrivilege	6028	takeown.exe
Token: SeTakeOwnershipPrivilege	8944	takeown.exe
Token: SeDebugPrivilege	9272	taskkill.exe
Token: SeTakeOwnershipPrivilege	9548	takeown.exe
Token: SeTakeOwnershipPrivilege	9936	takeown.exe
Token: SeDebugPrivilege	9676	taskkill.exe
Token: SeDebugPrivilege	9824	taskkill.exe
Token: SeTakeOwnershipPrivilege	6052	takeown.exe
Token: SeTakeOwnershipPrivilege	7336	takeown.exe
Token: SeDebugPrivilege	3264	taskkill.exe
Token: SeTakeOwnershipPrivilege	364	takeown.exe
Token: SeDebugPrivilege	7176	taskkill.exe
Token: SeDebugPrivilege	11044	taskkill.exe
Token: SeDebugPrivilege	12052	taskkill.exe
Token: SeTakeOwnershipPrivilege	10888	takeown.exe
Token: SeTakeOwnershipPrivilege	6324	takeown.exe
Token: SeTakeOwnershipPrivilege	636	takeown.exe
Token: SeTakeOwnershipPrivilege	5888	takeown.exe
Token: SeTakeOwnershipPrivilege	13884	takeown.exe
Token: SeTakeOwnershipPrivilege	13940	takeown.exe
Token: SeDebugPrivilege	14832	taskkill.exe
Token: SeDebugPrivilege	14960	taskkill.exe
Token: SeCreateGlobalPrivilege	11376	dwm.exe
Token: SeChangeNotifyPrivilege	11376	dwm.exe
Token: 33	11376	dwm.exe
Token: SeIncBasePriorityPrivilege	11376	dwm.exe
Token: SeDebugPrivilege	8108	taskkill.exe
Token: SeDebugPrivilege	12152	taskkill.exe
Token: SeDebugPrivilege	15160	taskkill.exe
Token: SeDebugPrivilege	12316	taskkill.exe
Token: SeTakeOwnershipPrivilege	15688	takeown.exe
Token: SeCreateGlobalPrivilege	12724	dwm.exe
Token: SeChangeNotifyPrivilege	12724	dwm.exe
Token: 33	12724	dwm.exe
Token: SeIncBasePriorityPrivilege	12724	dwm.exe
Token: SeCreateGlobalPrivilege	11696	dwm.exe
Token: SeChangeNotifyPrivilege	11696	dwm.exe
Token: 33	11696	dwm.exe
Token: SeIncBasePriorityPrivilege	11696	dwm.exe
Token: SeDebugPrivilege	2976	taskkill.exe
Token: SeCreateGlobalPrivilege	6556	dwm.exe
Token: SeChangeNotifyPrivilege	6556	dwm.exe
Token: 33	6556	dwm.exe
Token: SeIncBasePriorityPrivilege	6556	dwm.exe
Token: SeCreateGlobalPrivilege	932	dwm.exe
Token: SeChangeNotifyPrivilege	932	dwm.exe
Token: 33	932	dwm.exe
Token: SeIncBasePriorityPrivilege	932	dwm.exe
Token: SeCreateGlobalPrivilege	15376	dwm.exe
Token: SeChangeNotifyPrivilege	15376	dwm.exe
Token: 33	15376	dwm.exe
Token: SeIncBasePriorityPrivilege	15376	dwm.exe
Token: SeCreateGlobalPrivilege	8964	dwm.exe
Token: SeChangeNotifyPrivilege	8964	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2868	mspaint.exe
4440	mspaint.exe
1176	mspaint.exe
1176	mspaint.exe
4440	mspaint.exe
2868	mspaint.exe
1176	mspaint.exe
1176	mspaint.exe
2868	mspaint.exe
2868	mspaint.exe
4440	mspaint.exe
4440	mspaint.exe
4388	OpenWith.exe
1172	OpenWith.exe
5268	OpenWith.exe
6208	mspaint.exe
6208	mspaint.exe
6208	mspaint.exe
6208	mspaint.exe
6616	mspaint.exe
6572	mspaint.exe
6616	mspaint.exe
6616	mspaint.exe
6616	mspaint.exe
6572	mspaint.exe
6572	mspaint.exe
6572	mspaint.exe
6936	OpenWith.exe
7052	OpenWith.exe
6460	mspaint.exe
1716	mspaint.exe
7240	mspaint.exe
6460	mspaint.exe
6460	mspaint.exe
6460	mspaint.exe
7240	mspaint.exe
7240	mspaint.exe
7240	mspaint.exe
6512	OpenWith.exe
1716	mspaint.exe
1716	mspaint.exe
1716	mspaint.exe
7620	OpenWith.exe
7732	OpenWith.exe
7684	OpenWith.exe
8752	mspaint.exe
8752	mspaint.exe
8752	mspaint.exe
8752	mspaint.exe
9088	OpenWith.exe
6788	mspaint.exe
8700	OpenWith.exe
6788	mspaint.exe
6788	mspaint.exe
6788	mspaint.exe
9296	mspaint.exe
9296	mspaint.exe
9296	mspaint.exe
9296	mspaint.exe
10128	mspaint.exe
10128	mspaint.exe
10128	mspaint.exe
10128	mspaint.exe
7492	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1364 wrote to memory of 1472	1364	ADZP 20 Complex.exe	82
PID 1364 wrote to memory of 1472	1364	ADZP 20 Complex.exe	82
PID 1472 wrote to memory of 3340	1472	cmd.exe	83
PID 1472 wrote to memory of 3340	1472	cmd.exe	83
PID 1472 wrote to memory of 1376	1472	cmd.exe	85
PID 1472 wrote to memory of 1376	1472	cmd.exe	85
PID 1472 wrote to memory of 2956	1472	cmd.exe	87
PID 1472 wrote to memory of 2956	1472	cmd.exe	87
PID 1472 wrote to memory of 1028	1472	cmd.exe	88
PID 1472 wrote to memory of 1028	1472	cmd.exe	88
PID 1472 wrote to memory of 2316	1472	cmd.exe	89
PID 1472 wrote to memory of 2316	1472	cmd.exe	89
PID 1472 wrote to memory of 1368	1472	cmd.exe	91
PID 1472 wrote to memory of 1368	1472	cmd.exe	91
PID 1472 wrote to memory of 4228	1472	cmd.exe	92
PID 1472 wrote to memory of 4228	1472	cmd.exe	92
PID 1028 wrote to memory of 2392	1028	cmd.exe	93
PID 1028 wrote to memory of 2392	1028	cmd.exe	93
PID 1472 wrote to memory of 676	1472	cmd.exe	94
PID 1472 wrote to memory of 676	1472	cmd.exe	94
PID 1472 wrote to memory of 2440	1472	cmd.exe	96
PID 1472 wrote to memory of 2440	1472	cmd.exe	96
PID 1472 wrote to memory of 1880	1472	cmd.exe	97
PID 1472 wrote to memory of 1880	1472	cmd.exe	97
PID 1472 wrote to memory of 3680	1472	cmd.exe	98
PID 1472 wrote to memory of 3680	1472	cmd.exe	98
PID 1472 wrote to memory of 2344	1472	cmd.exe	99
PID 1472 wrote to memory of 2344	1472	cmd.exe	99
PID 1472 wrote to memory of 4840	1472	cmd.exe	100
PID 1472 wrote to memory of 4840	1472	cmd.exe	100
PID 1472 wrote to memory of 1300	1472	cmd.exe	101
PID 1472 wrote to memory of 1300	1472	cmd.exe	101
PID 1472 wrote to memory of 4788	1472	cmd.exe	102
PID 1472 wrote to memory of 4788	1472	cmd.exe	102
PID 1472 wrote to memory of 2964	1472	cmd.exe	103
PID 1472 wrote to memory of 2964	1472	cmd.exe	103
PID 1472 wrote to memory of 4996	1472	cmd.exe	104
PID 1472 wrote to memory of 4996	1472	cmd.exe	104
PID 1472 wrote to memory of 1960	1472	cmd.exe	105
PID 1472 wrote to memory of 1960	1472	cmd.exe	105
PID 1472 wrote to memory of 4824	1472	cmd.exe	106
PID 1472 wrote to memory of 4824	1472	cmd.exe	106
PID 1472 wrote to memory of 5116	1472	cmd.exe	107
PID 1472 wrote to memory of 5116	1472	cmd.exe	107
PID 1472 wrote to memory of 544	1472	cmd.exe	108
PID 1472 wrote to memory of 544	1472	cmd.exe	108
PID 1472 wrote to memory of 1468	1472	cmd.exe	170
PID 1472 wrote to memory of 1468	1472	cmd.exe	170
PID 1472 wrote to memory of 2152	1472	cmd.exe	110
PID 1472 wrote to memory of 2152	1472	cmd.exe	110
PID 1472 wrote to memory of 2152	1472	cmd.exe	110
PID 1472 wrote to memory of 2028	1472	cmd.exe	111
PID 1472 wrote to memory of 2028	1472	cmd.exe	111
PID 1472 wrote to memory of 3436	1472	cmd.exe	112
PID 1472 wrote to memory of 3436	1472	cmd.exe	112
PID 1472 wrote to memory of 2504	1472	cmd.exe	113
PID 1472 wrote to memory of 2504	1472	cmd.exe	113
PID 1472 wrote to memory of 2868	1472	cmd.exe	114
PID 1472 wrote to memory of 2868	1472	cmd.exe	114
PID 1472 wrote to memory of 1012	1472	cmd.exe	115
PID 1472 wrote to memory of 1012	1472	cmd.exe	115
PID 1472 wrote to memory of 1012	1472	cmd.exe	115
PID 1472 wrote to memory of 2144	1472	cmd.exe	116
PID 1472 wrote to memory of 2144	1472	cmd.exe	116

Views/modifies file attributes 1 TTPs 23 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
3476	attrib.exe
9808	attrib.exe
2976	attrib.exe
4924	attrib.exe
12464	attrib.exe
6444	attrib.exe
10340	attrib.exe
16184	attrib.exe
15824	attrib.exe
2408	attrib.exe
6068	attrib.exe
16152	attrib.exe
11676	attrib.exe
16144	attrib.exe
12024	attrib.exe
5432	attrib.exe
2440	attrib.exe
7768	attrib.exe
9868	attrib.exe
10148	attrib.exe
7176	attrib.exe
12448	attrib.exe
16344	attrib.exe

C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe
"C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1364
- C:\Windows\system32\cmd.exe
  "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\34CB.tmp\34CC.tmp\34CD.bat "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe""
  2⤵
  - Checks computer location settings
  - Drops autorun.inf file
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1472
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K Twain_20.cmd
    3⤵
    PID:3340
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K Twain_20.cmd
    3⤵
    PID:1376
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Informacion.vbs"
    3⤵
    PID:2956
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K Taskdl.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1028
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32" /r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      Suspicious use of AdjustPrivilegeToken
      PID:2392
- - C:\Windows\system32\reg.exe
    reg add hkey_local_machinesoftwaremicrosoftwindowscurrentversionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f
    3⤵
    PID:2316
- - C:\Windows\system32\reg.exe
    reg add hkey_current_usersoftwaremicrosoftwindowscurrentversionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f
    3⤵
    PID:1368
- - C:\Windows\system32\ipconfig.exe
    ipconfig /release
    3⤵
    - Gathers network information
    PID:4228
- - C:\Windows\system32\taskkill.exe
    taskkill /im DiskPart /f
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:676
- - C:\Windows\system32\attrib.exe
    attrib -r -a -s -h *.*
    3⤵
    - Drops autorun.inf file
    - Views/modifies file attributes
    PID:2440
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
    3⤵
    PID:1880
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
    3⤵
    PID:3680
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
    3⤵
    PID:2344
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
    3⤵
    PID:4840
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
    3⤵
    PID:1300
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
    3⤵
    PID:4788
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
    3⤵
    PID:2964
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
    3⤵
    PID:4996
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
    3⤵
    PID:1960
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
    3⤵
    PID:4824
- - C:\Windows\system32\msg.exe
    msg * Virus Detectado
    3⤵
    PID:5116
- - C:\Windows\system32\msg.exe
    msg * Virus Detectado
    3⤵
    PID:544
- - C:\Windows\system32\msg.exe
    msg * Has Sido Hackeado!
    3⤵
    PID:1468
- - C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe
    "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe"
    3⤵
    - Executes dropped EXE
    PID:2152
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\40C2.tmp\40C3.tmp\40C4.bat "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe""
      4⤵
      Checks computer location settings
      Drops autorun.inf file
      Drops file in System32 directory
      PID:1128
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        5⤵
        
        PID:5908
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        5⤵
        
        PID:5932
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Informacion.vbs"
        5⤵
        
        PID:224
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        5⤵
        
        PID:1596
      - C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        6⤵
        Possible privilege escalation attempt
        Modifies file permissions
        Suspicious use of AdjustPrivilegeToken
        
        PID:4252
    - - C:\Windows\system32\reg.exe
        
        reg add hkey_local_machinesoftwaremicrosoftwindowscurrentversionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f
        5⤵
        
        PID:4268
    - - C:\Windows\system32\reg.exe
        
        reg add hkey_current_usersoftwaremicrosoftwindowscurrentversionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f
        5⤵
        
        PID:4728
    - - C:\Windows\system32\ipconfig.exe
        
        ipconfig /release
        5⤵
        Gathers network information
        
        PID:3848
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /im DiskPart /f
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4916
    - - C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h *.*
        5⤵
        Drops autorun.inf file
        Views/modifies file attributes
        
        PID:3476
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        5⤵
        
        PID:876
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        5⤵
        
        PID:5308
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        5⤵
        
        PID:3848
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        5⤵
        
        PID:3972
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        5⤵
        
        PID:6152
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        5⤵
        
        PID:6216
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        5⤵
        
        PID:6656
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        5⤵
        
        PID:7040
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        5⤵
        
        PID:3344
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        5⤵
        
        PID:6260
    - - C:\Windows\system32\msg.exe
        
        msg * Virus Detectado
        5⤵
        
        PID:6952
    - - C:\Windows\system32\msg.exe
        
        msg * Virus Detectado
        5⤵
        
        PID:620
    - - C:\Windows\system32\msg.exe
        
        msg * Has Sido Hackeado!
        5⤵
        
        PID:5324
    - - C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe"
        5⤵
        Executes dropped EXE
        
        PID:6884
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\954B.tmp\954C.tmp\954D.bat "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe""
        6⤵
        Checks computer location settings
        Drops autorun.inf file
        Drops file in System32 directory
        Modifies registry class
        
        PID:7416
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        7⤵
        
        PID:7616
        
        C:\Windows\system32\reg.exe
        
        REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Twain_20 /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\Twain_20.cmd"
        8⤵
        
        PID:4504
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall set publicprofile state off
        7⤵
        Modifies Windows Firewall
        
        PID:7876
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        7⤵
        
        PID:7680
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Informacion.vbs"
        7⤵
        
        PID:8460
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        7⤵
        
        PID:8476
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        8⤵
        Possible privilege escalation attempt
        Modifies file permissions
        Suspicious use of AdjustPrivilegeToken
        
        PID:8944
        
        C:\Windows\system32\reg.exe
        
        reg add hkey_local_machinesoftwaremicrosoftwindowscurrentversionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f
        7⤵
        
        PID:8500
        
        C:\Windows\system32\reg.exe
        
        reg add hkey_current_usersoftwaremicrosoftwindowscurrentversionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f
        7⤵
        
        PID:8860
        
        C:\Windows\system32\ipconfig.exe
        
        ipconfig /release
        7⤵
        Gathers network information
        
        PID:372
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /im DiskPart /f
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:9824
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h *.*
        7⤵
        Drops autorun.inf file
        Views/modifies file attributes
        
        PID:6068
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        7⤵
        
        PID:9520
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        7⤵
        
        PID:8504
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        7⤵
        
        PID:8080
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        7⤵
        
        PID:10388
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        7⤵
        
        PID:10584
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        7⤵
        
        PID:10704
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        7⤵
        
        PID:10824
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        7⤵
        
        PID:10904
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        7⤵
        
        PID:10928
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        7⤵
        
        PID:11084
        
        C:\Windows\system32\msg.exe
        
        msg * Virus Detectado
        7⤵
        
        PID:11244
        
        C:\Windows\system32\msg.exe
        
        msg * Virus Detectado
        7⤵
        
        PID:10564
        
        C:\Windows\system32\msg.exe
        
        msg * Has Sido Hackeado!
        7⤵
        
        PID:10476
        
        C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe"
        7⤵
        Executes dropped EXE
        
        PID:11308
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\CFED.tmp\CFEE.tmp\CFEF.bat "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe""
        8⤵
        Drops autorun.inf file
        
        PID:11564
        
        C:\Windows\system32\notepad.exe
        
        notepad
        7⤵
        
        PID:11456
        
        C:\Windows\system32\calc.exe
        
        calc
        7⤵
        Modifies registry class
        
        PID:11732
        
        C:\Windows\explorer.exe
        
        explorer.exe
        7⤵
        Modifies registry class
        
        PID:11932
        
        C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        7⤵
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:12156
        
        C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe"
        7⤵
        Executes dropped EXE
        
        PID:5988
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\EEEF.tmp\EEF0.tmp\EEF1.bat "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe""
        8⤵
        Drops autorun.inf file
        Drops file in System32 directory
        
        PID:12348
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        9⤵
        
        PID:12668
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall set publicprofile state off
        9⤵
        Modifies Windows Firewall
        
        PID:9796
        
        C:\Windows\system32\reg.exe
        
        reg add hkey_local_machinesoftwaremicrosoftwindowscurrentversionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f
        9⤵
        
        PID:16368
        
        C:\Windows\system32\ipconfig.exe
        
        ipconfig /release
        9⤵
        Gathers network information
        
        PID:11732
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /im DiskPart /f
        9⤵
        Kills process with taskkill
        
        PID:2180
        
        C:\Windows\system32\notepad.exe
        
        notepad
        7⤵
        
        PID:8116
        
        C:\Windows\system32\calc.exe
        
        calc
        7⤵
        
        PID:11364
        
        C:\Windows\explorer.exe
        
        explorer.exe
        7⤵
        Modifies registry class
        
        PID:12368
        
        C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        7⤵
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:12644
        
        C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe"
        7⤵
        Executes dropped EXE
        
        PID:12916
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\BDD.tmp\BDE.tmp\BDF.bat "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe""
        8⤵
        Drops autorun.inf file
        Drops file in System32 directory
        
        PID:12664
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        9⤵
        
        PID:8496
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall set publicprofile state off
        9⤵
        Modifies Windows Firewall
        
        PID:14800
        
        C:\Windows\system32\notepad.exe
        
        notepad
        7⤵
        
        PID:13116
        
        C:\Windows\system32\calc.exe
        
        calc
        7⤵
        
        PID:8916
        
        C:\Windows\explorer.exe
        
        explorer.exe
        7⤵
        Modifies registry class
        
        PID:13088
        
        C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        7⤵
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:8500
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        7⤵
        
        PID:14516
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        7⤵
        
        PID:15260
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        7⤵
        
        PID:14728
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        7⤵
        
        PID:14856
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        7⤵
        
        PID:11424
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:5336
    - - C:\Windows\system32\calc.exe
        
        calc
        5⤵
        Modifies registry class
        
        PID:7084
    - - C:\Windows\explorer.exe
        
        explorer.exe
        5⤵
        Modifies registry class
        
        PID:6868
    - - C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        5⤵
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:1716
    - - C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe"
        5⤵
        Executes dropped EXE
        
        PID:3608
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\956A.tmp\956B.tmp\956C.bat "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe""
        6⤵
        Checks computer location settings
        Drops autorun.inf file
        Drops file in System32 directory
        
        PID:7448
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        7⤵
        
        PID:848
        
        C:\Windows\system32\reg.exe
        
        REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Twain_20 /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\Twain_20.cmd"
        8⤵
        
        PID:10112
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall set publicprofile state off
        7⤵
        Modifies Windows Firewall
        
        PID:5760
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        7⤵
        
        PID:10168
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Informacion.vbs"
        7⤵
        
        PID:6096
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        7⤵
        
        PID:6116
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        8⤵
        Possible privilege escalation attempt
        Modifies file permissions
        Suspicious use of AdjustPrivilegeToken
        
        PID:7336
        
        C:\Windows\system32\reg.exe
        
        reg add hkey_local_machinesoftwaremicrosoftwindowscurrentversionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f
        7⤵
        
        PID:10172
        
        C:\Windows\system32\reg.exe
        
        reg add hkey_current_usersoftwaremicrosoftwindowscurrentversionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f
        7⤵
        
        PID:9768
        
        C:\Windows\system32\ipconfig.exe
        
        ipconfig /release
        7⤵
        Gathers network information
        
        PID:10312
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /im DiskPart /f
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:11044
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h *.*
        7⤵
        Drops autorun.inf file
        Views/modifies file attributes
        
        PID:7176
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        7⤵
        
        PID:6692
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        7⤵
        
        PID:6016
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        7⤵
        
        PID:10156
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        7⤵
        
        PID:13724
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        7⤵
        
        PID:14076
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        7⤵
        
        PID:2100
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        7⤵
        
        PID:2812
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        7⤵
        
        PID:3016
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        7⤵
        
        PID:14464
        
        C:\Windows\system32\msg.exe
        
        msg * Virus Detectado
        7⤵
        
        PID:14852
        
        C:\Windows\system32\msg.exe
        
        msg * Has Sido Hackeado!
        7⤵
        
        PID:14944
        
        C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe"
        7⤵
        Executes dropped EXE
        
        PID:10844
        
        C:\Windows\system32\notepad.exe
        
        notepad
        7⤵
        
        PID:15036
        
        C:\Windows\system32\calc.exe
        
        calc
        7⤵
        Modifies registry class
        
        PID:10868
        
        C:\Windows\explorer.exe
        
        explorer.exe
        7⤵
        Modifies registry class
        
        PID:10668
        
        C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        7⤵
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:10712
        
        C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe"
        7⤵
        Executes dropped EXE
        
        PID:8212
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\1BB7.tmp\1BC8.tmp\1BC9.bat "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe""
        8⤵
        Checks computer location settings
        Drops autorun.inf file
        Drops file in System32 directory
        Modifies registry class
        
        PID:13392
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        9⤵
        
        PID:16136
        
        C:\Windows\system32\reg.exe
        
        REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Twain_20 /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\Twain_20.cmd"
        10⤵
        
        PID:15380
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall set publicprofile state off
        9⤵
        Modifies Windows Firewall
        
        PID:15884
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        9⤵
        
        PID:14876
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Informacion.vbs"
        9⤵
        
        PID:16204
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        9⤵
        
        PID:9280
        
        C:\Windows\system32\reg.exe
        
        reg add hkey_local_machinesoftwaremicrosoftwindowscurrentversionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f
        9⤵
        
        PID:12720
        
        C:\Windows\system32\reg.exe
        
        reg add hkey_current_usersoftwaremicrosoftwindowscurrentversionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f
        9⤵
        
        PID:64
        
        C:\Windows\system32\ipconfig.exe
        
        ipconfig /release
        9⤵
        Gathers network information
        
        PID:14676
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h *.*
        9⤵
        Drops autorun.inf file
        Views/modifies file attributes
        
        PID:12464
        
        C:\Windows\system32\notepad.exe
        
        notepad
        7⤵
        
        PID:10216
        
        C:\Windows\system32\calc.exe
        
        calc
        7⤵
        
        PID:14772
        
        C:\Windows\explorer.exe
        
        explorer.exe
        7⤵
        Modifies registry class
        
        PID:13520
        
        C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        7⤵
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:12032
        
        C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe"
        7⤵
        Executes dropped EXE
        
        PID:11484
        
        C:\Windows\system32\notepad.exe
        
        notepad
        7⤵
        
        PID:9744
        
        C:\Windows\system32\calc.exe
        
        calc
        7⤵
        Modifies registry class
        
        PID:12108
        
        C:\Windows\explorer.exe
        
        explorer.exe
        7⤵
        Modifies registry class
        
        PID:7744
        
        C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        7⤵
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:13064
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        7⤵
        
        PID:15600
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        7⤵
        
        PID:15952
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:6848
    - - C:\Windows\system32\calc.exe
        
        calc
        5⤵
        Modifies registry class
        
        PID:6916
    - - C:\Windows\explorer.exe
        
        explorer.exe
        5⤵
        Modifies registry class
        
        PID:6832
    - - C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        5⤵
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:6460
    - - C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe"
        5⤵
        Executes dropped EXE
        
        PID:6552
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\951C.tmp\951D.tmp\951E.bat "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe""
        6⤵
        Checks computer location settings
        Drops autorun.inf file
        Drops file in System32 directory
        
        PID:7372
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        7⤵
        
        PID:5708
        
        C:\Windows\system32\reg.exe
        
        REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Twain_20 /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\Twain_20.cmd"
        8⤵
        
        PID:5516
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall set publicprofile state off
        7⤵
        Modifies Windows Firewall
        
        PID:7380
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        7⤵
        
        PID:7540
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Informacion.vbs"
        7⤵
        
        PID:7512
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        7⤵
        
        PID:7504
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        8⤵
        Possible privilege escalation attempt
        Modifies file permissions
        Suspicious use of AdjustPrivilegeToken
        
        PID:6028
        
        C:\Windows\system32\reg.exe
        
        reg add hkey_local_machinesoftwaremicrosoftwindowscurrentversionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f
        7⤵
        
        PID:8396
        
        C:\Windows\system32\reg.exe
        
        reg add hkey_current_usersoftwaremicrosoftwindowscurrentversionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f
        7⤵
        
        PID:8784
        
        C:\Windows\system32\ipconfig.exe
        
        ipconfig /release
        7⤵
        Gathers network information
        
        PID:6536
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /im DiskPart /f
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:9272
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h *.*
        7⤵
        Drops autorun.inf file
        Views/modifies file attributes
        
        PID:9808
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        7⤵
        
        PID:9572
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        7⤵
        
        PID:7332
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        7⤵
        
        PID:7260
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        7⤵
        
        PID:1044
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        7⤵
        
        PID:3396
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        7⤵
        
        PID:8184
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        7⤵
        
        PID:10420
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        7⤵
        
        PID:10484
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        7⤵
        
        PID:10636
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        7⤵
        
        PID:10728
        
        C:\Windows\system32\msg.exe
        
        msg * Virus Detectado
        7⤵
        
        PID:10840
        
        C:\Windows\system32\msg.exe
        
        msg * Virus Detectado
        7⤵
        
        PID:11036
        
        C:\Windows\system32\msg.exe
        
        msg * Has Sido Hackeado!
        7⤵
        
        PID:1464
        
        C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe"
        7⤵
        Executes dropped EXE
        
        PID:1620
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\C222.tmp\C223.tmp\C224.bat "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe""
        8⤵
        Drops autorun.inf file
        Drops file in System32 directory
        
        PID:4928
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        9⤵
        
        PID:13772
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        10⤵
        
        PID:5324
        
        C:\Windows\system32\reg.exe
        
        REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Twain_20 /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\Twain_20.cmd"
        10⤵
        
        PID:14644
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall set publicprofile state off
        9⤵
        Modifies Windows Firewall
        
        PID:5852
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        9⤵
        
        PID:14812
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        9⤵
        
        PID:10700
        
        C:\Windows\system32\reg.exe
        
        reg add hkey_local_machinesoftwaremicrosoftwindowscurrentversionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f
        9⤵
        
        PID:6176
        
        C:\Windows\system32\reg.exe
        
        reg add hkey_current_usersoftwaremicrosoftwindowscurrentversionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f
        9⤵
        
        PID:14408
        
        C:\Windows\system32\ipconfig.exe
        
        ipconfig /release
        9⤵
        Gathers network information
        
        PID:11676
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h *.*
        9⤵
        Drops autorun.inf file
        Views/modifies file attributes
        
        PID:16344
        
        C:\Windows\system32\msg.exe
        
        msg * Virus Detectado
        9⤵
        
        PID:11688
        
        C:\Windows\system32\msg.exe
        
        msg * Virus Detectado
        9⤵
        
        PID:8416
        
        C:\Windows\system32\msg.exe
        
        msg * Has Sido Hackeado!
        9⤵
        
        PID:11940
        
        C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe"
        9⤵
        Executes dropped EXE
        
        PID:5416
        
        C:\Windows\system32\notepad.exe
        
        notepad
        7⤵
        
        PID:5436
        
        C:\Windows\system32\calc.exe
        
        calc
        7⤵
        Modifies registry class
        
        PID:5480
        
        C:\Windows\explorer.exe
        
        explorer.exe
        7⤵
        Modifies registry class
        
        PID:10888
        
        C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        7⤵
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:7028
        
        C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe"
        7⤵
        Executes dropped EXE
        
        PID:7556
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd" /c "C:\Users\Admin\AppData\Local\Temp\CADD.tmp\CADE.tmp\CAEE.bat "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe""
        8⤵
        Checks computer location settings
        Drops autorun.inf file
        Drops file in System32 directory
        Modifies registry class
        
        PID:4420
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        9⤵
        
        PID:11360
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        9⤵
        
        PID:1700
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Informacion.vbs"
        9⤵
        
        PID:732
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        9⤵
        
        PID:15436
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add hkey_local_machinesoftwaremicrosoftwindowscurrentversionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f
        9⤵
        
        PID:15992
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add hkey_current_usersoftwaremicrosoftwindowscurrentversionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f
        9⤵
        
        PID:16148
        
        C:\Windows\SysWOW64\ipconfig.exe
        
        ipconfig /release
        9⤵
        Gathers network information
        
        PID:16308
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im DiskPart /f
        9⤵
        Kills process with taskkill
        
        PID:6960
        
        C:\Windows\system32\notepad.exe
        
        notepad
        7⤵
        
        PID:164
        
        C:\Windows\system32\calc.exe
        
        calc
        7⤵
        Modifies registry class
        
        PID:11044
        
        C:\Windows\explorer.exe
        
        explorer.exe
        7⤵
        Modifies registry class
        
        PID:11400
        
        C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        7⤵
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:11652
        
        C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe"
        7⤵
        Executes dropped EXE
        
        PID:11888
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\E00A.tmp\E00B.tmp\E00C.bat "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe""
        8⤵
        Checks computer location settings
        Drops autorun.inf file
        Drops file in System32 directory
        
        PID:10324
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        9⤵
        
        PID:11252
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall set publicprofile state off
        9⤵
        Modifies Windows Firewall
        
        PID:2448
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Informacion.vbs"
        9⤵
        
        PID:14912
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        9⤵
        
        PID:8728
        
        C:\Windows\system32\reg.exe
        
        reg add hkey_local_machinesoftwaremicrosoftwindowscurrentversionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f
        9⤵
        
        PID:4888
        
        C:\Windows\system32\reg.exe
        
        reg add hkey_current_usersoftwaremicrosoftwindowscurrentversionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f
        9⤵
        
        PID:6148
        
        C:\Windows\system32\ipconfig.exe
        
        ipconfig /release
        9⤵
        Gathers network information
        
        PID:8008
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /im DiskPart /f
        9⤵
        Kills process with taskkill
        
        PID:6512
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h *.*
        9⤵
        Views/modifies file attributes
        
        PID:5432
        
        C:\Windows\system32\notepad.exe
        
        notepad
        7⤵
        
        PID:12060
        
        C:\Windows\system32\calc.exe
        
        calc
        7⤵
        Modifies registry class
        
        PID:12260
        
        C:\Windows\explorer.exe
        
        explorer.exe
        7⤵
        
        PID:1552
        
        C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        7⤵
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:8616
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        7⤵
        
        PID:3844
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        7⤵
        
        PID:1688
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        7⤵
        
        PID:6388
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        7⤵
        
        PID:14368
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        7⤵
        
        PID:14704
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        7⤵
        
        PID:15204
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:7200
    - - C:\Windows\system32\calc.exe
        
        calc
        5⤵
        
        PID:7208
    - - C:\Windows\explorer.exe
        
        explorer.exe
        5⤵
        Modifies registry class
        
        PID:7232
    - - C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        5⤵
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:7240
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        5⤵
        
        PID:8072
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        5⤵
        
        PID:8124
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        5⤵
        
        PID:8160
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        5⤵
        
        PID:4856
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        5⤵
        
        PID:7752
    - - C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe"
        5⤵
        Executes dropped EXE
        
        PID:4592
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:4904
    - - C:\Windows\system32\calc.exe
        
        calc
        5⤵
        
        PID:9068
    - - C:\Windows\explorer.exe
        
        explorer.exe
        5⤵
        
        PID:12588
    - - C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        5⤵
        
        PID:5076
    - - C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe"
        5⤵
        Executes dropped EXE
        
        PID:13020
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:12852
    - - C:\Windows\system32\calc.exe
        
        calc
        5⤵
        
        PID:12956
    - - C:\Windows\explorer.exe
        
        explorer.exe
        5⤵
        
        PID:14288
    - - C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        5⤵
        
        PID:8704
    - - C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe"
        5⤵
        Executes dropped EXE
        
        PID:13700
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:10072
    - - C:\Windows\system32\calc.exe
        
        calc
        5⤵
        
        PID:6860
    - - C:\Windows\explorer.exe
        
        explorer.exe
        5⤵
        
        PID:10188
    - - C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        5⤵
        
        PID:6320
    - - C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe"
        5⤵
        Executes dropped EXE
        
        PID:12388
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:10892
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:2028
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    - Modifies registry class
    PID:3436
- - C:\Windows\explorer.exe
    explorer.exe
    3⤵
    - Modifies registry class
    PID:2504
- - C:\Windows\system32\mspaint.exe
    mspaint.exe
    3⤵
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:2868
- - C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe
    "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe"
    3⤵
    - Executes dropped EXE
    PID:1012
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\40D2.tmp\40D3.tmp\40D4.bat "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe""
      4⤵
      Checks computer location settings
      Drops autorun.inf file
      Drops file in System32 directory
      Modifies registry class
      PID:384
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        5⤵
        
        PID:3936
      - C:\Windows\system32\reg.exe
        
        REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Twain_20 /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\Twain_20.cmd"
        6⤵
        
        PID:2044
    - - C:\Windows\system32\netsh.exe
        
        netsh advfirewall set publicprofile state off
        5⤵
        Modifies Windows Firewall
        
        PID:1660
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        5⤵
        
        PID:3924
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Informacion.vbs"
        5⤵
        
        PID:4320
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        5⤵
        
        PID:5588
      - C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        6⤵
        Possible privilege escalation attempt
        Modifies file permissions
        Suspicious use of AdjustPrivilegeToken
        
        PID:7128
    - - C:\Windows\system32\reg.exe
        
        reg add hkey_local_machinesoftwaremicrosoftwindowscurrentversionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f
        5⤵
        
        PID:6224
    - - C:\Windows\system32\reg.exe
        
        reg add hkey_current_usersoftwaremicrosoftwindowscurrentversionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f
        5⤵
        
        PID:6832
    - - C:\Windows\system32\ipconfig.exe
        
        ipconfig /release
        5⤵
        Gathers network information
        
        PID:7148
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /im DiskPart /f
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:7120
    - - C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h *.*
        5⤵
        Drops autorun.inf file
        Views/modifies file attributes
        
        PID:7768
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        5⤵
        
        PID:7248
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        5⤵
        
        PID:7760
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        5⤵
        
        PID:5892
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        5⤵
        
        PID:5772
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        5⤵
        
        PID:7052
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        5⤵
        
        PID:8232
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        5⤵
        
        PID:8468
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        5⤵
        
        PID:8656
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        5⤵
        
        PID:8884
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        5⤵
        
        PID:9052
    - - C:\Windows\system32\msg.exe
        
        msg * Virus Detectado
        5⤵
        
        PID:6012
    - - C:\Windows\system32\msg.exe
        
        msg * Virus Detectado
        5⤵
        
        PID:8688
    - - C:\Windows\system32\msg.exe
        
        msg * Has Sido Hackeado!
        5⤵
        
        PID:9568
    - - C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe"
        5⤵
        Executes dropped EXE
        
        PID:9800
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\2A66.tmp\2A67.tmp\2A68.bat "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe""
        6⤵
        Checks computer location settings
        Drops autorun.inf file
        Drops file in System32 directory
        Modifies registry class
        
        PID:9920
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        7⤵
        
        PID:960
        
        C:\Windows\system32\reg.exe
        
        REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Twain_20 /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\Twain_20.cmd"
        8⤵
        
        PID:6060
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall set publicprofile state off
        7⤵
        Modifies Windows Firewall
        
        PID:5696
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        7⤵
        
        PID:4584
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Informacion.vbs"
        7⤵
        
        PID:10100
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        7⤵
        
        PID:9096
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        8⤵
        Possible privilege escalation attempt
        Modifies file permissions
        Suspicious use of AdjustPrivilegeToken
        
        PID:364
        
        C:\Windows\system32\reg.exe
        
        reg add hkey_local_machinesoftwaremicrosoftwindowscurrentversionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f
        7⤵
        
        PID:5788
        
        C:\Windows\system32\reg.exe
        
        reg add hkey_current_usersoftwaremicrosoftwindowscurrentversionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f
        7⤵
        
        PID:1620
        
        C:\Windows\system32\ipconfig.exe
        
        ipconfig /release
        7⤵
        Gathers network information
        
        PID:10320
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /im DiskPart /f
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:12052
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h *.*
        7⤵
        Drops autorun.inf file
        Views/modifies file attributes
        
        PID:12448
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        7⤵
        
        PID:14344
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        7⤵
        
        PID:15144
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        7⤵
        
        PID:14652
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        7⤵
        
        PID:14500
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        7⤵
        
        PID:14668
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        7⤵
        
        PID:4492
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        7⤵
        
        PID:15580
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        7⤵
        
        PID:15960
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:9876
    - - C:\Windows\system32\calc.exe
        
        calc
        5⤵
        
        PID:9964
    - - C:\Windows\explorer.exe
        
        explorer.exe
        5⤵
        
        PID:10040
    - - C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        5⤵
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:10128
    - - C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe"
        5⤵
        Executes dropped EXE
        
        PID:8252
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:8688
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\337F.tmp\3380.tmp\3381.bat "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe""
        6⤵
        Checks computer location settings
        Drops autorun.inf file
        Drops file in System32 directory
        Modifies registry class
        
        PID:9460
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        7⤵
        
        PID:12708
        
        C:\Windows\System32\Twain_20.dll
        
        C:\Windows\System32\Twain_20.dll
        8⤵
        Executes dropped EXE
        
        PID:8596
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\2AFE.tmp\2AFF.tmp\2B00.bat C:\Windows\System32\Twain_20.dll"
        9⤵
        Drops autorun.inf file
        
        PID:4932
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall set publicprofile state off
        7⤵
        Modifies Windows Firewall
        
        PID:9196
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Informacion.vbs"
        7⤵
        
        PID:428
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        7⤵
        
        PID:4628
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        8⤵
        Possible privilege escalation attempt
        Modifies file permissions
        Suspicious use of AdjustPrivilegeToken
        
        PID:13884
        
        C:\Windows\system32\reg.exe
        
        reg add hkey_local_machinesoftwaremicrosoftwindowscurrentversionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f
        7⤵
        
        PID:13920
        
        C:\Windows\system32\reg.exe
        
        reg add hkey_current_usersoftwaremicrosoftwindowscurrentversionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f
        7⤵
        
        PID:11004
        
        C:\Windows\system32\ipconfig.exe
        
        ipconfig /release
        7⤵
        Gathers network information
        
        PID:10448
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /im DiskPart /f
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:12152
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h *.*
        7⤵
        Drops autorun.inf file
        Views/modifies file attributes
        
        PID:16184
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:9364
    - - C:\Windows\system32\calc.exe
        
        calc
        5⤵
        
        PID:9100
    - - C:\Windows\explorer.exe
        
        explorer.exe
        5⤵
        
        PID:9628
    - - C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        5⤵
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:2288
    - - C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe"
        5⤵
        Executes dropped EXE
        
        PID:4752
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\491A.tmp\491B.tmp\491C.bat "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe""
        6⤵
        Checks computer location settings
        Drops autorun.inf file
        Drops file in System32 directory
        Modifies registry class
        
        PID:10136
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        7⤵
        
        PID:12444
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall set publicprofile state off
        7⤵
        Modifies Windows Firewall
        
        PID:8180
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Informacion.vbs"
        7⤵
        
        PID:13476
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        7⤵
        
        PID:13840
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        8⤵
        Possible privilege escalation attempt
        Modifies file permissions
        Suspicious use of AdjustPrivilegeToken
        
        PID:13940
        
        C:\Windows\system32\reg.exe
        
        reg add hkey_local_machinesoftwaremicrosoftwindowscurrentversionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f
        7⤵
        
        PID:13864
        
        C:\Windows\system32\reg.exe
        
        reg add hkey_current_usersoftwaremicrosoftwindowscurrentversionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f
        7⤵
        
        PID:13512
        
        C:\Windows\system32\ipconfig.exe
        
        ipconfig /release
        7⤵
        Gathers network information
        
        PID:14772
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /im DiskPart /f
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:8108
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h *.*
        7⤵
        Drops autorun.inf file
        Views/modifies file attributes
        
        PID:16152
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        7⤵
        
        PID:13856
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:9812
    - - C:\Windows\system32\calc.exe
        
        calc
        5⤵
        
        PID:8600
    - - C:\Windows\explorer.exe
        
        explorer.exe
        5⤵
        Modifies registry class
        
        PID:5584
    - - C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        5⤵
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:5896
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        5⤵
        
        PID:9676
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        5⤵
        
        PID:9776
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        5⤵
        
        PID:9396
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        5⤵
        
        PID:9088
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        5⤵
        
        PID:9264
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:2144
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    - Modifies registry class
    PID:4168
- - C:\Windows\explorer.exe
    explorer.exe
    3⤵
    PID:2408
- - C:\Windows\system32\mspaint.exe
    mspaint.exe
    3⤵
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:1176
- - C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe
    "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe"
    3⤵
    - Executes dropped EXE
    PID:1824
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\40A3.tmp\40A4.tmp\40A5.bat "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe""
      4⤵
      Checks computer location settings
      Drops autorun.inf file
      Drops file in System32 directory
      PID:4236
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        5⤵
        
        PID:888
      - C:\Windows\system32\reg.exe
        
        REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Twain_20 /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\Twain_20.cmd"
        6⤵
        Adds Run key to start application
        
        PID:5796
      - C:\Windows\System32\Twain_20.dll
        
        C:\Windows\System32\Twain_20.dll
        6⤵
        Executes dropped EXE
        
        PID:6032
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\55FF.tmp\5600.tmp\5611.bat C:\Windows\System32\Twain_20.dll"
        7⤵
        Checks computer location settings
        Drops autorun.inf file
        Drops file in System32 directory
        Modifies registry class
        
        PID:6088
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        8⤵
        
        PID:1468
        
        C:\Windows\system32\reg.exe
        
        REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Twain_20 /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\Twain_20.cmd"
        9⤵
        
        PID:3928
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall set publicprofile state off
        8⤵
        Modifies Windows Firewall
        
        PID:3180
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        8⤵
        
        PID:4132
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Informacion.vbs"
        8⤵
        
        PID:5652
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        8⤵
        
        PID:5832
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        9⤵
        Possible privilege escalation attempt
        Modifies file permissions
        Suspicious use of AdjustPrivilegeToken
        
        PID:6112
        
        C:\Windows\system32\reg.exe
        
        reg add hkey_local_machinesoftwaremicrosoftwindowscurrentversionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f
        8⤵
        
        PID:2576
        
        C:\Windows\system32\reg.exe
        
        reg add hkey_current_usersoftwaremicrosoftwindowscurrentversionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f
        8⤵
        
        PID:3952
        
        C:\Windows\system32\ipconfig.exe
        
        ipconfig /release
        8⤵
        Gathers network information
        
        PID:4228
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /im DiskPart /f
        8⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:6868
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h *.*
        8⤵
        Drops autorun.inf file
        Views/modifies file attributes
        
        PID:6444
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        8⤵
        
        PID:7860
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        8⤵
        
        PID:8060
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        8⤵
        
        PID:7612
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        8⤵
        
        PID:7836
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        8⤵
        
        PID:2724
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        8⤵
        
        PID:2696
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        8⤵
        
        PID:7268
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        8⤵
        
        PID:7084
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        8⤵
        
        PID:7152
        
        C:\Windows\system32\msg.exe
        
        msg * Virus Detectado
        8⤵
        
        PID:7756
        
        C:\Windows\system32\msg.exe
        
        msg * Virus Detectado
        8⤵
        
        PID:7492
        
        C:\Windows\system32\msg.exe
        
        msg * Has Sido Hackeado!
        8⤵
        
        PID:5192
        
        C:\Windows\System32\Twain_20.dll
        
        C:\Windows\System32\Twain_20.dll
        8⤵
        Executes dropped EXE
        
        PID:8220
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\F2DC.tmp\F2DD.tmp\F2DE.bat C:\Windows\System32\Twain_20.dll"
        9⤵
        Checks computer location settings
        Drops autorun.inf file
        Drops file in System32 directory
        Modifies registry class
        
        PID:8380
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        10⤵
        
        PID:9332
        
        C:\Windows\system32\reg.exe
        
        REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Twain_20 /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\Twain_20.cmd"
        11⤵
        
        PID:7176
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall set publicprofile state off
        10⤵
        Modifies Windows Firewall
        
        PID:5456
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        10⤵
        
        PID:3112
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Informacion.vbs"
        10⤵
        
        PID:5480
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        10⤵
        
        PID:12296
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        11⤵
        Possible privilege escalation attempt
        Modifies file permissions
        Suspicious use of AdjustPrivilegeToken
        
        PID:10888
        
        C:\Windows\system32\reg.exe
        
        reg add hkey_local_machinesoftwaremicrosoftwindowscurrentversionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f
        10⤵
        
        PID:4848
        
        C:\Windows\system32\reg.exe
        
        reg add hkey_current_usersoftwaremicrosoftwindowscurrentversionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f
        10⤵
        
        PID:9956
        
        C:\Windows\system32\ipconfig.exe
        
        ipconfig /release
        10⤵
        Gathers network information
        
        PID:10036
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /im DiskPart /f
        10⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:14832
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h *.*
        10⤵
        Drops autorun.inf file
        Views/modifies file attributes
        
        PID:2976
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        10⤵
        
        PID:1444
        
        C:\Windows\system32\notepad.exe
        
        notepad
        8⤵
        
        PID:8320
        
        C:\Windows\system32\calc.exe
        
        calc
        8⤵
        Modifies registry class
        
        PID:8424
        
        C:\Windows\explorer.exe
        
        explorer.exe
        8⤵
        Modifies registry class
        
        PID:8632
        
        C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        8⤵
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:8752
        
        C:\Windows\System32\Twain_20.dll
        
        C:\Windows\System32\Twain_20.dll
        8⤵
        Executes dropped EXE
        
        PID:8828
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\FE84.tmp\1F0.tmp\210.bat C:\Windows\System32\Twain_20.dll"
        9⤵
        Checks computer location settings
        Drops autorun.inf file
        Drops file in System32 directory
        Modifies registry class
        
        PID:9180
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        10⤵
        
        PID:10808
        
        C:\Windows\system32\reg.exe
        
        REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Twain_20 /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\Twain_20.cmd"
        11⤵
        
        PID:11440
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall set publicprofile state off
        10⤵
        Modifies Windows Firewall
        
        PID:10364
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        10⤵
        
        PID:10960
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Informacion.vbs"
        10⤵
        
        PID:2292
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        10⤵
        
        PID:8400
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        11⤵
        Possible privilege escalation attempt
        Modifies file permissions
        Suspicious use of AdjustPrivilegeToken
        
        PID:6324
        
        C:\Windows\system32\reg.exe
        
        reg add hkey_local_machinesoftwaremicrosoftwindowscurrentversionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f
        10⤵
        
        PID:11344
        
        C:\Windows\system32\reg.exe
        
        reg add hkey_current_usersoftwaremicrosoftwindowscurrentversionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f
        10⤵
        
        PID:12152
        
        C:\Windows\system32\ipconfig.exe
        
        ipconfig /release
        10⤵
        Gathers network information
        
        PID:8108
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /im DiskPart /f
        10⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:14960
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h *.*
        10⤵
        Views/modifies file attributes
        
        PID:4924
        
        C:\Windows\system32\notepad.exe
        
        notepad
        8⤵
        
        PID:8872
        
        C:\Windows\system32\calc.exe
        
        calc
        8⤵
        
        PID:8904
        
        C:\Windows\explorer.exe
        
        explorer.exe
        8⤵
        Modifies registry class
        
        PID:9160
        
        C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        8⤵
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:6788
        
        C:\Windows\System32\Twain_20.dll
        
        C:\Windows\System32\Twain_20.dll
        8⤵
        Executes dropped EXE
        
        PID:8520
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\BF2.tmp\BF3.tmp\BF4.bat C:\Windows\System32\Twain_20.dll"
        9⤵
        Checks computer location settings
        Drops autorun.inf file
        Drops file in System32 directory
        
        PID:9136
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        10⤵
        
        PID:11244
        
        C:\Windows\system32\reg.exe
        
        REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Twain_20 /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\Twain_20.cmd"
        11⤵
        
        PID:11952
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall set publicprofile state off
        10⤵
        Modifies Windows Firewall
        
        PID:3120
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Informacion.vbs"
        10⤵
        
        PID:13080
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        10⤵
        
        PID:9024
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        11⤵
        Possible privilege escalation attempt
        Modifies file permissions
        Suspicious use of AdjustPrivilegeToken
        
        PID:636
        
        C:\Windows\system32\reg.exe
        
        reg add hkey_local_machinesoftwaremicrosoftwindowscurrentversionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f
        10⤵
        
        PID:11220
        
        C:\Windows\system32\reg.exe
        
        reg add hkey_current_usersoftwaremicrosoftwindowscurrentversionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f
        10⤵
        
        PID:5100
        
        C:\Windows\system32\ipconfig.exe
        
        ipconfig /release
        10⤵
        Gathers network information
        
        PID:5348
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /im DiskPart /f
        10⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:15160
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h *.*
        10⤵
        Drops autorun.inf file
        Views/modifies file attributes
        
        PID:11676
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        10⤵
        
        PID:9744
        
        C:\Windows\system32\notepad.exe
        
        notepad
        8⤵
        
        PID:9028
        
        C:\Windows\system32\calc.exe
        
        calc
        8⤵
        Modifies registry class
        
        PID:5204
        
        C:\Windows\explorer.exe
        
        explorer.exe
        8⤵
        Modifies registry class
        
        PID:8748
        
        C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        8⤵
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:9296
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        8⤵
        
        PID:1640
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        8⤵
        
        PID:6420
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        8⤵
        
        PID:3404
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        8⤵
        
        PID:4892
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        8⤵
        
        PID:1188
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        8⤵
        
        PID:1924
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        5⤵
        
        PID:5148
      - C:\Windows\system32\reg.exe
        
        REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Twain_20 /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\Twain_20.cmd"
        6⤵
        
        PID:5880
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        5⤵
        
        PID:5164
      - C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        6⤵
        Possible privilege escalation attempt
        Modifies file permissions
        Suspicious use of AdjustPrivilegeToken
        
        PID:6004
    - - C:\Windows\system32\reg.exe
        
        reg add hkey_local_machinesoftwaremicrosoftwindowscurrentversionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f
        5⤵
        
        PID:5652
    - - C:\Windows\system32\reg.exe
        
        reg add hkey_current_usersoftwaremicrosoftwindowscurrentversionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f
        5⤵
        
        PID:5864
    - - C:\Windows\system32\ipconfig.exe
        
        ipconfig /release
        5⤵
        Gathers network information
        
        PID:6072
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /im DiskPart /f
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1996
    - - C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h *.*
        5⤵
        Drops autorun.inf file
        Views/modifies file attributes
        
        PID:2408
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        5⤵
        
        PID:5792
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        5⤵
        
        PID:2372
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        5⤵
        
        PID:5744
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        5⤵
        
        PID:1172
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        5⤵
        
        PID:3424
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        5⤵
        
        PID:4244
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        5⤵
        
        PID:4268
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        5⤵
        
        PID:4728
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        5⤵
        
        PID:5156
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        5⤵
        
        PID:1132
    - - C:\Windows\system32\msg.exe
        
        msg * Virus Detectado
        5⤵
        
        PID:5316
    - - C:\Windows\system32\msg.exe
        
        msg * Virus Detectado
        5⤵
        
        PID:2424
    - - C:\Windows\system32\msg.exe
        
        msg * Has Sido Hackeado!
        5⤵
        
        PID:4892
    - - C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe"
        5⤵
        Executes dropped EXE
        
        PID:5872
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\7AED.tmp\7AEE.tmp\7AEF.bat "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe""
        6⤵
        Checks computer location settings
        Drops autorun.inf file
        Drops file in System32 directory
        Modifies registry class
        
        PID:6340
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        7⤵
        
        PID:9448
        
        C:\Windows\System32\Twain_20.dll
        
        C:\Windows\System32\Twain_20.dll
        8⤵
        Executes dropped EXE
        
        PID:10028
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\2DE1.tmp\2DE2.tmp\2DE3.bat C:\Windows\System32\Twain_20.dll"
        9⤵
        Checks computer location settings
        Drops autorun.inf file
        Drops file in System32 directory
        
        PID:10076
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        10⤵
        
        PID:10652
        
        C:\Windows\System32\Twain_20.dll
        
        C:\Windows\System32\Twain_20.dll
        11⤵
        Executes dropped EXE
        
        PID:11912
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\1A64.tmp\1A84.tmp\1A85.bat C:\Windows\System32\Twain_20.dll"
        12⤵
        Checks computer location settings
        Drops autorun.inf file
        Drops file in System32 directory
        Modifies registry class
        
        PID:10376
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall set publicprofile state off
        13⤵
        Modifies Windows Firewall
        
        PID:15932
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Informacion.vbs"
        13⤵
        
        PID:13132
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        13⤵
        
        PID:2740
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        14⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:8536
        
        C:\Windows\system32\reg.exe
        
        reg add hkey_local_machinesoftwaremicrosoftwindowscurrentversionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f
        13⤵
        
        PID:14972
        
        C:\Windows\system32\reg.exe
        
        reg add hkey_current_usersoftwaremicrosoftwindowscurrentversionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f
        13⤵
        
        PID:7988
        
        C:\Windows\system32\ipconfig.exe
        
        ipconfig /release
        13⤵
        Gathers network information
        
        PID:11128
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /im DiskPart /f
        13⤵
        Kills process with taskkill
        
        PID:4668
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h *.*
        13⤵
        Drops autorun.inf file
        Views/modifies file attributes
        
        PID:12024
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall set publicprofile state off
        10⤵
        Modifies Windows Firewall
        
        PID:12536
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        10⤵
        
        PID:12860
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Informacion.vbs"
        10⤵
        
        PID:7928
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        10⤵
        
        PID:6200
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        11⤵
        Possible privilege escalation attempt
        Modifies file permissions
        Suspicious use of AdjustPrivilegeToken
        
        PID:5888
        
        C:\Windows\system32\reg.exe
        
        reg add hkey_local_machinesoftwaremicrosoftwindowscurrentversionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f
        10⤵
        
        PID:13316
        
        C:\Windows\system32\reg.exe
        
        reg add hkey_current_usersoftwaremicrosoftwindowscurrentversionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f
        10⤵
        
        PID:14060
        
        C:\Windows\system32\ipconfig.exe
        
        ipconfig /release
        10⤵
        Gathers network information
        
        PID:2324
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /im DiskPart /f
        10⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:12316
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        10⤵
        
        PID:11080
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        10⤵
        
        PID:11420
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        10⤵
        
        PID:14376
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        10⤵
        
        PID:12488
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall set publicprofile state off
        7⤵
        Modifies Windows Firewall
        
        PID:9732
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        7⤵
        
        PID:10192
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        7⤵
        
        PID:3652
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        8⤵
        Possible privilege escalation attempt
        Modifies file permissions
        Suspicious use of AdjustPrivilegeToken
        
        PID:6052
        
        C:\Windows\system32\reg.exe
        
        reg add hkey_local_machinesoftwaremicrosoftwindowscurrentversionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f
        7⤵
        
        PID:9964
        
        C:\Windows\system32\reg.exe
        
        reg add hkey_current_usersoftwaremicrosoftwindowscurrentversionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f
        7⤵
        
        PID:3412
        
        C:\Windows\system32\ipconfig.exe
        
        ipconfig /release
        7⤵
        Gathers network information
        
        PID:10148
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /im DiskPart /f
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:7176
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h *.*
        7⤵
        Drops autorun.inf file
        Views/modifies file attributes
        
        PID:10340
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        7⤵
        
        PID:11448
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        7⤵
        
        PID:11988
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        7⤵
        
        PID:3896
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        7⤵
        
        PID:12376
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        7⤵
        
        PID:12964
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        7⤵
        
        PID:5696
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        7⤵
        
        PID:3196
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        7⤵
        
        PID:1288
        
        C:\Windows\system32\msg.exe
        
        msg * Virus Detectado
        7⤵
        
        PID:6196
        
        C:\Windows\system32\msg.exe
        
        msg * Virus Detectado
        7⤵
        
        PID:6928
        
        C:\Windows\system32\msg.exe
        
        msg * Has Sido Hackeado!
        7⤵
        
        PID:8916
        
        C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe"
        7⤵
        Executes dropped EXE
        
        PID:1000
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\6C2D.tmp\6C2E.tmp\6C2F.bat "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe""
        8⤵
        Drops autorun.inf file
        Drops file in System32 directory
        
        PID:13660
        
        C:\Windows\system32\notepad.exe
        
        notepad
        7⤵
        
        PID:11644
        
        C:\Windows\system32\calc.exe
        
        calc
        7⤵
        Modifies registry class
        
        PID:8044
        
        C:\Windows\explorer.exe
        
        explorer.exe
        7⤵
        Modifies registry class
        
        PID:9596
        
        C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        7⤵
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:13052
        
        C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe"
        7⤵
        Executes dropped EXE
        
        PID:4264
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\6AD6.tmp\6AD7.tmp\6AD8.bat "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe""
        8⤵
        Checks computer location settings
        Drops autorun.inf file
        Drops file in System32 directory
        Modifies registry class
        
        PID:13504
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        9⤵
        
        PID:15444
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall set publicprofile state off
        9⤵
        Modifies Windows Firewall
        
        PID:15608
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Informacion.vbs"
        9⤵
        
        PID:5800
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        9⤵
        
        PID:11252
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        10⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:12484
        
        C:\Windows\system32\reg.exe
        
        reg add hkey_local_machinesoftwaremicrosoftwindowscurrentversionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f
        9⤵
        
        PID:2960
        
        C:\Windows\system32\reg.exe
        
        reg add hkey_current_usersoftwaremicrosoftwindowscurrentversionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f
        9⤵
        
        PID:15844
        
        C:\Windows\system32\ipconfig.exe
        
        ipconfig /release
        9⤵
        Gathers network information
        
        PID:13068
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h *.*
        9⤵
        Drops autorun.inf file
        Views/modifies file attributes
        
        PID:15824
        
        C:\Windows\system32\notepad.exe
        
        notepad
        7⤵
        
        PID:9616
        
        C:\Windows\system32\calc.exe
        
        calc
        7⤵
        Modifies registry class
        
        PID:12052
        
        C:\Windows\explorer.exe
        
        explorer.exe
        7⤵
        
        PID:2100
        
        C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        7⤵
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:6332
        
        C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe"
        7⤵
        Executes dropped EXE
        
        PID:11732
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\6A49.tmp\6A4A.tmp\6A4B.bat "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe""
        8⤵
        Drops autorun.inf file
        Drops file in System32 directory
        
        PID:13468
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        9⤵
        
        PID:12416
        
        C:\Windows\system32\notepad.exe
        
        notepad
        7⤵
        
        PID:12936
        
        C:\Windows\system32\calc.exe
        
        calc
        7⤵
        Modifies registry class
        
        PID:9020
        
        C:\Windows\explorer.exe
        
        explorer.exe
        7⤵
        Modifies registry class
        
        PID:11336
        
        C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        7⤵
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:8048
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        7⤵
        
        PID:13548
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        7⤵
        
        PID:13964
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        7⤵
        
        PID:1656
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        7⤵
        
        PID:13140
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        7⤵
        
        PID:6760
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:5284
    - - C:\Windows\system32\calc.exe
        
        calc
        5⤵
        Modifies registry class
        
        PID:528
    - - C:\Windows\explorer.exe
        
        explorer.exe
        5⤵
        
        PID:6180
    - - C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        5⤵
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:6208
    - - C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe"
        5⤵
        Executes dropped EXE
        
        PID:6236
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\7C64.tmp\7C65.tmp\7C66.bat "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe""
        6⤵
        Checks computer location settings
        Drops autorun.inf file
        Drops file in System32 directory
        Modifies registry class
        
        PID:6436
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        7⤵
        
        PID:8544
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall set publicprofile state off
        7⤵
        Modifies Windows Firewall
        
        PID:8812
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        7⤵
        
        PID:9120
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Informacion.vbs"
        7⤵
        
        PID:9188
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        7⤵
        
        PID:9384
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        8⤵
        Possible privilege escalation attempt
        Modifies file permissions
        Suspicious use of AdjustPrivilegeToken
        
        PID:9548
        
        C:\Windows\system32\reg.exe
        
        reg add hkey_local_machinesoftwaremicrosoftwindowscurrentversionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f
        7⤵
        
        PID:9460
        
        C:\Windows\system32\reg.exe
        
        reg add hkey_current_usersoftwaremicrosoftwindowscurrentversionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f
        7⤵
        
        PID:9632
        
        C:\Windows\system32\ipconfig.exe
        
        ipconfig /release
        7⤵
        Gathers network information
        
        PID:9664
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /im DiskPart /f
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:9676
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h *.*
        7⤵
        Drops autorun.inf file
        Views/modifies file attributes
        
        PID:9868
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        7⤵
        
        PID:3056
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        7⤵
        
        PID:10272
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        7⤵
        
        PID:10432
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        7⤵
        
        PID:10464
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        7⤵
        
        PID:10620
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        7⤵
        
        PID:10760
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        7⤵
        
        PID:10896
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        7⤵
        
        PID:10992
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        7⤵
        
        PID:11164
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        7⤵
        
        PID:5020
        
        C:\Windows\system32\msg.exe
        
        msg * Virus Detectado
        7⤵
        
        PID:10380
        
        C:\Windows\system32\msg.exe
        
        msg * Virus Detectado
        7⤵
        
        PID:5488
        
        C:\Windows\system32\msg.exe
        
        msg * Has Sido Hackeado!
        7⤵
        
        PID:10476
        
        C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe"
        7⤵
        Executes dropped EXE
        
        PID:11704
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\D721.tmp\D732.tmp\D733.bat "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe""
        8⤵
        Drops autorun.inf file
        
        PID:12004
        
        C:\Windows\system32\notepad.exe
        
        notepad
        7⤵
        
        PID:11916
        
        C:\Windows\system32\calc.exe
        
        calc
        7⤵
        Modifies registry class
        
        PID:12132
        
        C:\Windows\explorer.exe
        
        explorer.exe
        7⤵
        Modifies registry class
        
        PID:8400
        
        C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        7⤵
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:11744
        
        C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe"
        7⤵
        Executes dropped EXE
        
        PID:11968
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\F671.tmp\F672.tmp\F673.bat "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe""
        8⤵
        Drops autorun.inf file
        
        PID:12668
        
        C:\Windows\system32\notepad.exe
        
        notepad
        7⤵
        
        PID:12308
        
        C:\Windows\system32\calc.exe
        
        calc
        7⤵
        Modifies registry class
        
        PID:12560
        
        C:\Windows\explorer.exe
        
        explorer.exe
        7⤵
        Modifies registry class
        
        PID:12868
        
        C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        7⤵
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:13092
        
        C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe"
        7⤵
        Executes dropped EXE
        
        PID:12344
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd" /c "C:\Users\Admin\AppData\Local\Temp\1C96.tmp\1C97.tmp\1C98.bat "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe""
        8⤵
        Checks computer location settings
        Drops autorun.inf file
        Drops file in System32 directory
        
        PID:12040
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        9⤵
        
        PID:15420
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        9⤵
        
        PID:15648
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Informacion.vbs"
        9⤵
        
        PID:10204
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        9⤵
        
        PID:16152
        
        C:\Windows\SysWOW64\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        10⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:15280
        
        C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\System32" /reset /t /c /q
        10⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:13432
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add hkey_local_machinesoftwaremicrosoftwindowscurrentversionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f
        9⤵
        
        PID:11504
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add hkey_current_usersoftwaremicrosoftwindowscurrentversionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f
        9⤵
        
        PID:10440
        
        C:\Windows\SysWOW64\ipconfig.exe
        
        ipconfig /release
        9⤵
        Gathers network information
        
        PID:12372
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im DiskPart /f
        9⤵
        Kills process with taskkill
        
        PID:1360
        
        C:\Windows\system32\notepad.exe
        
        notepad
        7⤵
        
        PID:12940
        
        C:\Windows\system32\calc.exe
        
        calc
        7⤵
        Modifies registry class
        
        PID:11336
        
        C:\Windows\explorer.exe
        
        explorer.exe
        7⤵
        Modifies registry class
        
        PID:10092
        
        C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        7⤵
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:9908
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        7⤵
        
        PID:9020
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        7⤵
        
        PID:14436
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        7⤵
        
        PID:14852
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        7⤵
        
        PID:12228
        
        C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe"
        7⤵
        Executes dropped EXE
        
        PID:7460
        
        C:\Windows\system32\notepad.exe
        
        notepad
        7⤵
        
        PID:13204
        
        C:\Windows\system32\calc.exe
        
        calc
        7⤵
        
        PID:13236
        
        C:\Windows\explorer.exe
        
        explorer.exe
        7⤵
        
        PID:10260
        
        C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        7⤵
        Drops file in Windows directory
        
        PID:7344
        
        C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe"
        7⤵
        Executes dropped EXE
        
        PID:11804
        
        C:\Windows\system32\notepad.exe
        
        notepad
        7⤵
        
        PID:12084
        
        C:\Windows\system32\calc.exe
        
        calc
        7⤵
        
        PID:11872
        
        C:\Windows\explorer.exe
        
        explorer.exe
        7⤵
        
        PID:6868
        
        C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        7⤵
        Drops file in Windows directory
        
        PID:2448
        
        C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe"
        7⤵
        Executes dropped EXE
        
        PID:16036
        
        C:\Windows\system32\notepad.exe
        
        notepad
        7⤵
        
        PID:15724
        
        C:\Windows\system32\calc.exe
        
        calc
        7⤵
        
        PID:7424
        
        C:\Windows\explorer.exe
        
        explorer.exe
        7⤵
        
        PID:7436
        
        C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        7⤵
        Drops file in Windows directory
        
        PID:9712
        
        C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe"
        7⤵
        Executes dropped EXE
        
        PID:8912
        
        C:\Windows\system32\notepad.exe
        
        notepad
        7⤵
        
        PID:11908
        
        C:\Windows\system32\calc.exe
        
        calc
        7⤵
        
        PID:11960
        
        C:\Windows\explorer.exe
        
        explorer.exe
        7⤵
        
        PID:13268
        
        C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        7⤵
        
        PID:15060
        
        C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe"
        7⤵
        Executes dropped EXE
        
        PID:11832
        
        C:\Windows\system32\notepad.exe
        
        notepad
        7⤵
        
        PID:5176
        
        C:\Windows\system32\calc.exe
        
        calc
        7⤵
        
        PID:12016
        
        C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe"
        7⤵
        Executes dropped EXE
        
        PID:4160
        
        C:\Windows\system32\notepad.exe
        
        notepad
        7⤵
        
        PID:9964
        
        C:\Windows\system32\calc.exe
        
        calc
        7⤵
        
        PID:11724
        
        C:\Windows\explorer.exe
        
        explorer.exe
        7⤵
        
        PID:13536
        
        C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        7⤵
        
        PID:1268
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:6404
    - - C:\Windows\system32\calc.exe
        
        calc
        5⤵
        
        PID:6548
    - - C:\Windows\explorer.exe
        
        explorer.exe
        5⤵
        Modifies registry class
        
        PID:6564
    - - C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        5⤵
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:6572
    - - C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe"
        5⤵
        Executes dropped EXE
        
        PID:6580
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\80C9.tmp\80CA.tmp\80CB.bat "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe""
        6⤵
        Checks computer location settings
        Drops autorun.inf file
        Drops file in System32 directory
        Modifies registry class
        
        PID:6920
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        7⤵
        
        PID:5532
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall set publicprofile state off
        7⤵
        Modifies Windows Firewall
        
        PID:2052
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Informacion.vbs"
        7⤵
        
        PID:9060
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        7⤵
        
        PID:9320
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        8⤵
        Possible privilege escalation attempt
        Modifies file permissions
        Suspicious use of AdjustPrivilegeToken
        
        PID:9936
        
        C:\Windows\system32\reg.exe
        
        reg add hkey_local_machinesoftwaremicrosoftwindowscurrentversionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f
        7⤵
        
        PID:9956
        
        C:\Windows\system32\reg.exe
        
        reg add hkey_current_usersoftwaremicrosoftwindowscurrentversionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f
        7⤵
        
        PID:9088
        
        C:\Windows\system32\ipconfig.exe
        
        ipconfig /release
        7⤵
        Gathers network information
        
        PID:9768
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /im DiskPart /f
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3264
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h *.*
        7⤵
        Drops autorun.inf file
        Views/modifies file attributes
        
        PID:10148
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        7⤵
        
        PID:11588
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        7⤵
        
        PID:12552
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        7⤵
        
        PID:12804
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        7⤵
        
        PID:13308
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        7⤵
        
        PID:9600
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        7⤵
        
        PID:13060
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        7⤵
        
        PID:9668
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        7⤵
        
        PID:12880
        
        C:\Windows\system32\msg.exe
        
        msg * Virus Detectado
        7⤵
        
        PID:5276
        
        C:\Windows\system32\msg.exe
        
        msg * Virus Detectado
        7⤵
        
        PID:13696
        
        C:\Windows\system32\msg.exe
        
        msg * Has Sido Hackeado!
        7⤵
        
        PID:13316
        
        C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe"
        7⤵
        Executes dropped EXE
        
        PID:5800
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\8B2F.tmp\8B30.tmp\8B31.bat "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe""
        8⤵
        Drops autorun.inf file
        Drops file in System32 directory
        
        PID:2416
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        9⤵
        
        PID:6448
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall set publicprofile state off
        9⤵
        Modifies Windows Firewall
        
        PID:15284
        
        C:\Windows\system32\notepad.exe
        
        notepad
        7⤵
        
        PID:13836
        
        C:\Windows\system32\calc.exe
        
        calc
        7⤵
        Modifies registry class
        
        PID:8284
        
        C:\Windows\explorer.exe
        
        explorer.exe
        7⤵
        
        PID:8692
        
        C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        7⤵
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:6816
        
        C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe"
        7⤵
        Executes dropped EXE
        
        PID:14504
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\A3B8.tmp\A3B9.tmp\A3BA.bat "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe""
        8⤵
        Checks computer location settings
        Drops autorun.inf file
        Drops file in System32 directory
        Modifies registry class
        
        PID:14720
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        9⤵
        
        PID:8980
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall set publicprofile state off
        9⤵
        Modifies Windows Firewall
        
        PID:11964
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        9⤵
        
        PID:15812
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Informacion.vbs"
        9⤵
        
        PID:16264
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        9⤵
        
        PID:15496
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        10⤵
        Possible privilege escalation attempt
        Modifies file permissions
        Suspicious use of AdjustPrivilegeToken
        
        PID:15688
        
        C:\Windows\system32\reg.exe
        
        reg add hkey_local_machinesoftwaremicrosoftwindowscurrentversionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f
        9⤵
        
        PID:8676
        
        C:\Windows\system32\ipconfig.exe
        
        ipconfig /release
        9⤵
        Gathers network information
        
        PID:12136
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /im DiskPart /f
        9⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2976
        
        C:\Windows\system32\notepad.exe
        
        notepad
        7⤵
        
        PID:14656
        
        C:\Windows\system32\calc.exe
        
        calc
        7⤵
        Modifies registry class
        
        PID:14824
        
        C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        7⤵
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:15324
        
        C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe"
        7⤵
        Executes dropped EXE
        
        PID:6980
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\B07A.tmp\B07B.tmp\B07C.bat "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.exe""
        8⤵
        Checks computer location settings
        Drops autorun.inf file
        Drops file in System32 directory
        Modifies registry class
        
        PID:14152
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall set publicprofile state off
        9⤵
        Modifies Windows Firewall
        
        PID:16020
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Informacion.vbs"
        9⤵
        
        PID:12916
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        9⤵
        
        PID:8744
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        10⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:2944
        
        C:\Windows\system32\reg.exe
        
        reg add hkey_local_machinesoftwaremicrosoftwindowscurrentversionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f
        9⤵
        
        PID:16056
        
        C:\Windows\system32\reg.exe
        
        reg add hkey_current_usersoftwaremicrosoftwindowscurrentversionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f
        9⤵
        
        PID:10924
        
        C:\Windows\system32\ipconfig.exe
        
        ipconfig /release
        9⤵
        Gathers network information
        
        PID:8392
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h *.*
        9⤵
        Drops autorun.inf file
        Views/modifies file attributes
        
        PID:16144
        
        C:\Windows\system32\notepad.exe
        
        notepad
        7⤵
        
        PID:10780
        
        C:\Windows\system32\calc.exe
        
        calc
        7⤵
        
        PID:9236
        
        C:\Windows\explorer.exe
        
        explorer.exe
        7⤵
        
        PID:14760
        
        C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        7⤵
        
        PID:15032
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        7⤵
        
        PID:9344
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        7⤵
        
        PID:10444
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        7⤵
        
        PID:9696
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        7⤵
        
        PID:15564
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        7⤵
        
        PID:15944
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        7⤵
        
        PID:16120
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:6588
    - - C:\Windows\system32\calc.exe
        
        calc
        5⤵
        Modifies registry class
        
        PID:6600
    - - C:\Windows\explorer.exe
        
        explorer.exe
        5⤵
        Modifies registry class
        
        PID:6608
    - - C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        5⤵
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:6616
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        5⤵
        
        PID:6956
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        5⤵
        
        PID:6412
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:4576
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:1652
- - C:\Windows\explorer.exe
    explorer.exe
    3⤵
    - Modifies registry class
    PID:3848
- - C:\Windows\system32\mspaint.exe
    mspaint.exe
    3⤵
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:4440
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
    3⤵
    PID:5296
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
    3⤵
    PID:5356
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
    3⤵
    PID:5376
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
    3⤵
    PID:5384
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
    3⤵
    PID:5404
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
    3⤵
    PID:5460

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4388

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:4372

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1172

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:5268

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:6512

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:6936

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:7052

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:7620

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:7684

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:7732

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:8700

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:9088

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:7492

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:10120

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:4152

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:9160

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:3116

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:11620

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:12096

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:8016

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:6692

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:12456

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:13156

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:11332

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:1688

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:13516

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:13712

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:13852

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:13448

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:6528

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:14916

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:11376

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:10480

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:15736

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:15876

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:12724

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:11696

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:6556

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:932

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:15376

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:8964

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
PID:6940

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
PID:14732

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
PID:10160

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:13556

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:15920

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:15276

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:14544

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:11380

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:11860

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:13744

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:12068

C:\Windows\system32\werfault.exe
werfault.exe /hc /shared Global\3b96511061ef4fb5bc4e98e977a6e925 /t 3904 /p 3876
1⤵
PID:9500

C:\Windows\system32\werfault.exe
werfault.exe /hc /shared Global\808dc9b3f60240028c8e81d6669099a6 /t 1776 /p 4536
1⤵
PID:13216

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:8604

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:8924

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000124 00000084
1⤵
PID:15280

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000ec 00000084
1⤵
PID:9384

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 0000010c 00000084
1⤵
PID:9732

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 0000010c 00000084
1⤵
PID:9548

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000dc 00000084
1⤵
PID:10040

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000c0 00000084
1⤵
PID:9460

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000124 00000084
1⤵
PID:9936

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000248 00000084
1⤵
PID:9632

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 0000014c 00000084
1⤵
PID:8600

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000104 00000084
1⤵
PID:848

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 0000010c 00000084
1⤵
PID:9100

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000e4 00000084
1⤵
PID:9364

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000c0 00000084
1⤵
PID:9676

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000108 00000084
1⤵
PID:11704

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000134 00000084
1⤵
PID:5348

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000f4 00000084
1⤵
PID:11252

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000f4 00000084
1⤵
PID:2292

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000f4 00000084
1⤵
PID:12964

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000d8 00000084
1⤵
PID:12444

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000a8 00000084
1⤵
PID:12344

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000a8 00000084
1⤵
PID:6324

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000118 00000084
1⤵
PID:5100

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000fc 00000084
1⤵
PID:14504

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000f4 00000084
1⤵
PID:13772

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000128 00000084
1⤵
PID:13392

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 0000014c 00000084
1⤵
PID:12668

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000120 00000084
1⤵
PID:6448

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000144 00000084
1⤵
PID:10808

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000dc 00000084
1⤵
PID:16136

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 0000013c 00000084
1⤵
PID:15420

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000f8 00000084
1⤵
PID:8912

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000110 00000084
1⤵
PID:14656

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000dc 00000084
1⤵
PID:14376

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000110 00000084
1⤵
PID:1288

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000d0 00000084
1⤵
PID:2100

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000f4 00000084
1⤵
PID:10712

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000104 00000084
1⤵
PID:10128

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000e4 00000084
1⤵
PID:6816

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 0000011c 00000084
1⤵
PID:12348

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000130 00000084
1⤵
PID:12552

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000130 00000084
1⤵
PID:11588

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000001d4 00000084
1⤵
PID:5480

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000001bc 00000084
1⤵
PID:10156

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000198 00000084
1⤵
PID:11336

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 0000016c 00000084
1⤵
PID:14076

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000160 00000084
1⤵
PID:1924

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000e8 00000084
1⤵
PID:5584

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000108 00000084
1⤵
PID:5896

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000124 00000084
1⤵
PID:2288

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000e4 00000084
1⤵
PID:9964

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000134 00000084
1⤵
PID:3412

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000d0 00000084
1⤵
PID:10312

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 0000011c 00000084
1⤵
PID:1464

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 0000011c 00000084
1⤵
PID:10172

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 0000013c 00000084
1⤵
PID:11932

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 0000013c 00000084
1⤵
PID:11308

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000128 00000084
1⤵
PID:3264

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000d8 00000084
1⤵
PID:960

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000f4 00000084
1⤵
PID:4628

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 0000010c 00000084
1⤵
PID:10036

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000ec 00000084
1⤵
PID:10380

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000144 00000084
1⤵
PID:9824

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 0000012c 00000084
1⤵
PID:6052

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000108 00000084
1⤵
PID:4584

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000140 00000084
1⤵
PID:10112

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000108 00000084
1⤵
PID:5760

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000168 00000084
1⤵
PID:9676

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000f4 00000084
1⤵
PID:9264

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000a8 00000084
1⤵
PID:10388

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000dc 00000084
1⤵
PID:1044

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000168 00000084
1⤵
PID:10432

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000f4 00000084
1⤵
PID:7332

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000108 00000084
1⤵
PID:10168

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 0000011c 00000084
1⤵
PID:6420

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 0000011c 00000084
1⤵
PID:9396

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000d8 00000084
1⤵
PID:10148

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000108 00000084
1⤵
PID:1640

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000ec 00000084
1⤵
PID:9776

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000d0 00000084
1⤵
PID:10840

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000134 00000084
1⤵
PID:13884

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000130 00000084
1⤵
PID:11888

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000d8 00000084
1⤵
PID:10376

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 0000011c 00000084
1⤵
PID:11912

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000104 00000084
1⤵
PID:8596

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000104 00000084
1⤵
PID:11044

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000108 00000084
1⤵
PID:9196

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 0000012c 00000084
1⤵
PID:9024

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000144 00000084
1⤵
PID:12448

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000144 00000084
1⤵
PID:12708

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 0000012c 00000084
1⤵
PID:10960

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 0000012c 00000084
1⤵
PID:6116

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000d8 00000084
1⤵
PID:7336

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000140 00000084
1⤵
PID:364

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000140 00000084
1⤵
PID:5788

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000104 00000084
1⤵
PID:5988

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000108 00000084
1⤵
PID:13116

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000130 00000084
1⤵
PID:11456

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000c0 00000084
1⤵
PID:11644

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000130 00000084
1⤵
PID:14368

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000a8 00000084
1⤵
PID:12308

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 0000012c 00000084
1⤵
PID:12060

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000a8 00000084
1⤵
PID:12940

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000fc 00000084
1⤵
PID:12936

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000a8 00000084
1⤵
PID:13836

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000158 00000084
1⤵
PID:164

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000140 00000084
1⤵
PID:5436

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000144 00000084
1⤵
PID:10324

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000a8 00000084
1⤵
PID:9020

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000158 00000084
1⤵
PID:10420

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000128 00000084
1⤵
PID:9520

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000d8 00000084
1⤵
PID:8504

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 0000012c 00000084
1⤵
PID:10928

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000104 00000084
1⤵
PID:10272

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 0000011c 00000084
1⤵
PID:3896

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000104 00000084
1⤵
PID:10484

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000108 00000084
1⤵
PID:10760

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000158 00000084
1⤵
PID:10896

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000108 00000084
1⤵
PID:11084

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000d8 00000084
1⤵
PID:12916

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000128 00000084
1⤵
PID:3016

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 0000011c 00000084
1⤵
PID:10100

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000ec 00000084
1⤵
PID:9572

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000140 00000084
1⤵
PID:8184

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000108 00000084
1⤵
PID:10728

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000ec 00000084
1⤵
PID:3396

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000140 00000084
1⤵
PID:6096

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000d8 00000084
1⤵
PID:14772

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000d8 00000084
1⤵
PID:3404

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 0000011c 00000084
1⤵
PID:11988

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000128 00000084
1⤵
PID:10704

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000140 00000084
1⤵
PID:12040

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000158 00000084
1⤵
PID:10824

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000140 00000084
1⤵
PID:14720

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000114 00000084
1⤵
PID:13840

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000128 00000084
1⤵
PID:11440

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000174 00000084
1⤵
PID:11036

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000a8 00000084
1⤵
PID:7176

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000d8 00000084
1⤵
PID:3844

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000d8 00000084
1⤵
PID:11744

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000d8 00000084
1⤵
PID:8616

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000140 00000084
1⤵
PID:1688

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000e4 00000084
1⤵
PID:10148

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 0000013c 00000084
1⤵
PID:13308

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000168 00000084
1⤵
PID:11400

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000fc 00000084
1⤵
PID:5276

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 0000010c 00000084
1⤵
PID:12004

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000c0 00000084
1⤵
PID:6332

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000c0 00000084
1⤵
PID:7260

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000fc 00000084
1⤵
PID:1188

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000a8 00000084
1⤵
PID:9236

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000104 00000084
1⤵
PID:12560

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000124 00000084
1⤵
PID:11564

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000174 00000084
1⤵
PID:11004

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000d8 00000084
1⤵
PID:5456

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000180 00000084
1⤵
PID:5488

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000130 00000084
1⤵
PID:16148

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000ec 00000084
1⤵
PID:9768

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000134 00000084
1⤵
PID:10364

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 0000013c 00000084
1⤵
PID:11968

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 0000013c 00000084
1⤵
PID:10888

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000c0 00000084
1⤵
PID:11244

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000ec 00000084
1⤵
PID:7028

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000188 00000084
1⤵
PID:11916

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000ec 00000084
1⤵
PID:8116

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000104 00000084
1⤵
PID:10620

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000130 00000084
1⤵
PID:11448

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 0000010c 00000084
1⤵
PID:10904

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000104 00000084
1⤵
PID:10992

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000128 00000084
1⤵
PID:11164

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000c0 00000084
1⤵
PID:8400

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000128 00000084
1⤵
PID:3112

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 0000010c 00000084
1⤵
PID:9332

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000188 00000084
1⤵
PID:11652

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000e4 00000084
1⤵
PID:11952

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000d8 00000084
1⤵
PID:10476

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000134 00000084
1⤵
PID:5020

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000144 00000084
1⤵
PID:7556

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000144 00000084
1⤵
PID:1620

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000104 00000084
1⤵
PID:12644

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000188 00000084
1⤵
PID:12156

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000158 00000084
1⤵
PID:11732

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000124 00000084
1⤵
PID:13092

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000188 00000084
1⤵
PID:7928

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000158 00000084
1⤵
PID:8180

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000144 00000084
1⤵
PID:3196

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000188 00000084
1⤵
PID:4420

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000130 00000084
1⤵
PID:4928

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000c0 00000084
1⤵
PID:13940

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000130 00000084
1⤵
PID:13724

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000128 00000084
1⤵
PID:4848

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000168 00000084
1⤵
PID:10564

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000130 00000084
1⤵
PID:9956

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000144 00000084
1⤵
PID:12132

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000144 00000084
1⤵
PID:9908

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000130 00000084
1⤵
PID:6928

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000d8 00000084
1⤵
PID:11364

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000144 00000084
1⤵
PID:12368

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000174 00000084
1⤵
PID:12260

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000144 00000084
1⤵
PID:12052

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000d0 00000084
1⤵
PID:15932

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000188 00000084
1⤵
PID:12868

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000174 00000084
1⤵
PID:11220

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000188 00000084
1⤵
PID:13696

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000128 00000084
1⤵
PID:13088

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000188 00000084
1⤵
PID:15160

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 0000012c 00000084
1⤵
PID:11676

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000124 00000084
1⤵
PID:8916

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000a8 00000084
1⤵
PID:5852

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000128 00000084
1⤵
PID:12664

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000128 00000084
1⤵
PID:1552

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000140 00000084
1⤵
PID:15608

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000e4 00000084
1⤵
PID:13316

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000130 00000084
1⤵
PID:15032

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000e4 00000084
1⤵
PID:12296

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000130 00000084
1⤵
PID:10888

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 0000011c 00000084
1⤵
PID:10652

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000e4 00000084
1⤵
PID:16152

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000124 00000084
1⤵
PID:12860

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000174 00000084
1⤵
PID:4264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

34CD.bat

Path C:\Users\Admin\AppData\Local\Temp\34CB.tmp\34CC.tmp\34CD.bat
Size 17KB
SHA256 faee2b0ac2218435a6973b87277b29010c988efefdcd7fe0e107808c2cc0f282
MD5 190e7cfa7d6de532ba4498ca3d38b47d
SHA1 7d4ea5ce61962c0445d955a44dd31226fa8c736e
SHA512 5a87b4bac67957acbc6dfab08cf9b3e1110e4b496b66110a44f7b2d0ec75b950d7569b6220c4a5ab3597db032e70b16d5a5e6ee4ab23102f6d12fea7bdc11598
SSDEEP 192:Kn0iMJWap3ahz9j3E301VaYYATCdhSouXKN:PJWo3yzHVbYMW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Advertencia.vbs

Path C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs
Size 240B
SHA256 093b0f0c3f7a9bf24406662245b57f171837a266aba49f198319045e971e77d5
MD5 482dcfe952218cf31ad2adddd8f6616b
SHA1 7a6bcfce28c76bc3319c871696531d21200f3bc0
SHA512 440182ba5cd7c85abc11fe9097a41486469afde738d26f471efe4e7928106cd57240b1045bc97d60c42147ca25b032c4149487f1a1ab4581292c7eff2bc801b9
MD5 SHA1 SHA512

Submit Download

Advertencia.vbs

Path C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs
Size 300B
SHA256 0783070444c465de8a21f7fc41f61d2bd535e995454e4086b2e01780e96ad419
MD5 88a2fcd93445c8b092324fe1236d31dc
SHA1 f63653fe34d54b7e42e29689a934ed097329128d
SHA512 3e44cce194b1cc3d6946d33dee6756f0333edc886f9ebe8149887c2e9b35867575ed47f15b2c384ed37aab3b8e37dae3369e1259d132bdf9bb832c70c09e8085
MD5 SHA1 SHA512

Submit Download

Advertencia.vbs

Path C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs
Size 360B
SHA256 530f6ebaf4445acb0855efc516729598a3312aeedd0ef9024da6f347f152e783
MD5 8d485f3ac2acb6e586e8f1d8af2df57f
SHA1 43e9653ecedbad263a5e015ecaa3eebb7a44feb9
SHA512 4105fa612f86d46457f77449c095cd9e1f59dcb4d137bf3d822e4f52f89c517faadfbaa00b07d15aabfc0d2afdb093ea63d59add313525149f17b7427917494b
MD5 SHA1 SHA512

Submit Download

Advertencia.vbs

Path C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs
Size 60B
SHA256 8dfd0a6db2df60455840dbbbcc4f8b70d730ba1c2afbf300316898b3dd3e9b11
MD5 11aa52a7eca2cf8fdcd1584b5a8b6026
SHA1 01ae6066e6b3879cb0caf306cc91077b7c0bea1e
SHA512 07f37c050eb59e7a1a228ca851d05ca9b62bb3de97f988fb36c374c827833c8c551e5cb51eb05130861c0b35515ca77ae667ca97ee4f08c86cdf9f6fb64533c5
MD5 SHA1 SHA512

Submit Download

Autorun.inf

Path C:\Users\Admin\AppData\Local\Temp\Autorun.inf
Size 222B
SHA256 fd8427db8c0c5ad2c7a8fc36c18f9400e25bdd7dfd1d267ec11a7a94bdbd1cab
MD5 05a4d4594b598cfe885bf862787b8cde
SHA1 dfb26e156e88af25bd00db0bc788b81c521a4db9
SHA512 ac1f87eabd69e1939f463c8710cdd1ba8a886ad6509d26d0fac4e09ab82056cf952b7a0cf2ecb55bb0549fdb0aff6457133eeb6b7b222df58f773f91df101136
MD5 SHA1 SHA512

Submit Download

Autorun.inf

Path C:\Users\Admin\AppData\Local\Temp\Autorun.inf
Size 370B
SHA256 005939c96c791e50f2aa446ad812e3bfeae8297fee51c7f6e543d1d6571882a3
MD5 3fdd19fb2a886abcccbbb2d3253b43ea
SHA1 56f40cec4c6287084f3fe5147a929e9c6d81ab41
SHA512 cdc92751c460ef659637ff239479503f13c701bddb704799e173e6b2e9ad90fd551b5cbf2dd060ecadc0f9f450e2c49656a74a9a36f7d82b919d92dca234e467
MD5 SHA1 SHA512

Submit Download

Autorun.inf

Path C:\Users\Admin\AppData\Local\Temp\Autorun.inf
Size 74B
SHA256 12a5135510016abcfe1192aceb6fec42634346661d778d68be1debaa3d75e967
MD5 b39df423c6e5978065a9a8ec4879a3b4
SHA1 96441a7a7d8090f7a96a1160f539531f66568e88
SHA512 2d583fcae1ec73f836c5b66b8b1337bb4250a8230073de96d501a4fab5f522b75599ac2a1fcf1457a841d8c84bcccb88feade82f49357b28345c63d9526cfeb4
MD5 SHA1 SHA512

Submit Download

ErrorCritico.vbs

Path C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs
Size 216B
SHA256 71bd0bffdeca9dce2b4e9e1d767a0732657032171f3ad33903dec353ef95a431
MD5 7659392a12010d8c761cb9888f6fd5ac
SHA1 b8829c26628740b77ab7405c231f420e860d8c1f
SHA512 5caf94b288649b687f411cbb5519168e09e161f8d9545a6bad1b0d08876a542d153a115f8b44e3f15d973812ce8ec7471bba7d8bd0b9a22d0abf6fdf2914a2bf
MD5 SHA1 SHA512

Submit Download

ErrorCritico.vbs

Path C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs
Size 270B
SHA256 838ba55eb15df2e0145178a20b4d01314d0fcde04ff871649012eaeba6bbfb69
MD5 adad2cd23a8880d4b3bdb1481c5b7998
SHA1 823fc1acc3e7a3f0cffab5cb8fa453a8c0d1872c
SHA512 8c600e32157daef85549d0a19a40f38e812e05cbf24e51453fa1ea94435e55fe4a705e77d42a4f63f3c565da98b4e69f1ed7bb6f3dbca65e80b17526954e60e4
MD5 SHA1 SHA512

Submit Download

ErrorCritico.vbs

Path C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs
Size 324B
SHA256 61bf3a4e7eb43119fb6f69c2d63872f35b9b6d79fd5a846ad824951ccea9898f
MD5 b260589bc116e407e75412be10ce0c7c
SHA1 b3498d228b26ad13ba76b27d624ef5eef940221c
SHA512 007b78a36ea10d91360610ceec313bfa51c663c719859edf95dae0cdb75bdbbe6908bf0cb4c3f2e237539e0e20dc64266328e8a82ad5a7c90b59b6f56f683c4f
MD5 SHA1 SHA512

Submit Download

ErrorCritico.vbs

Path C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs
Size 54B
SHA256 616cf19739e00c69e9606d9c94869f6fcb6a7b3860e7b8af9bc896f3081dad0d
MD5 888e64c554686bbbc0499057cce1af36
SHA1 5a7f51c66e3ae7dd0e0231c9817aee8c9fc54006
SHA512 9882375fdd09d489258447d49b8b63d0bc8db57cdb7186500c00c79d57f30af5f37a69e8fab70683a7c9d730e3484ef537ee57bb1892a84f92e9aba639d1d227
MD5 SHA1 SHA512

Submit Download

Informacion.vbs

Path C:\Users\Admin\AppData\Local\Temp\Informacion.vbs
Size 207B
SHA256 ea0bdd86d283aba33d619aeecb5087ad9132b58e8ae7121e3c3774504abb976a
MD5 d3715d7f77349116a701484780269375
SHA1 589c48410637ac33431569b867070a51c4de5b1c
SHA512 9526a79ac4f9a18104f8e84d684136eef9b6bbccfe772d1d1030d9be02de2f7221cdee248ec748971551a42ed1d8fb1c8a9d820b837164f68376cdee1dc8ff3a
MD5 SHA1 SHA512

Submit Download

Informacion.vbs

Path C:\Users\Admin\AppData\Local\Temp\Informacion.vbs
Size 276B
SHA256 2cda289b5067c9daf8b4dffdf323b2fe9d0a47bfdbb91b4a017029bc74729c05
MD5 089381a847f01ba0962ae00f0d92d5e8
SHA1 9f3240f89871639778a318e0cadccafcf9d7c55e
SHA512 89fbf1b423f17101970290b070d740b8d58beecc6723e64edb7ae23b9285afe3a612b8e8f5ec202d60aca3875a28dbc556a43af9fe4113ac0bdba1fa83c5213a
MD5 SHA1 SHA512

Submit Download

Informacion.vbs

Path C:\Users\Admin\AppData\Local\Temp\Informacion.vbs
Size 345B
SHA256 20fa853d5be5b8f30eeb6ae3e24558a2091d80102944ab26b9861df5cea6c6fa
MD5 baa511e0932e6c0781dd1488615d17a6
SHA1 e3218aefe8c272ade02eb6cc5188df6d50b04de0
SHA512 24be7fabda63dd82dfb5307e2ae0dc7176bf59c0918f1316bddb7515e0695b10cd6e24420af4afcda3d5f1b01e3d540a2d75a629f40c381da05eb3c28ff4697e
MD5 SHA1 SHA512

Submit Download

Informacion.vbs

Path C:\Users\Admin\AppData\Local\Temp\Informacion.vbs
Size 69B
SHA256 d9fc0446467e00e640f0dd0bf36882943a6993dcc1038ba8f73239152896eb25
MD5 72946942abf5cf295f726b816c531ebf
SHA1 8ac5ccae8003c3776c2e0ee0959a76c8bc913495
SHA512 2f42b10e2c1359a690e1a69e307008e3beb4712e4c071d916fb1380c61cb2ed3ae48c86af44c6f1c9d613e85dd75d8cfd66fd01de0649444ee6d5193d9789d23
MD5 SHA1 SHA512

Submit Download

Informacion.vbs

Path C:\Users\Admin\AppData\Local\Temp\Informacion.vbs
Size 1KB
SHA256 725c53af4c854475759da82ec802d9f126e3dea1dcc523576dcfa71bf1d4325f
MD5 0da9e7906a0c5c66118db8f74aaeb510
SHA1 83f94b0bb8ba53749962c48a0816833ee76224da
SHA512 47638baabbe723ff410550b9b4da382b48eb2be55704556edc4966067c31613f9e3a297514aac5c32fc4ba6fc2f63377da8e20f439ec58d8b03b2258654817ba
MD5 SHA1 SHA512

Submit Download

Taskdl.bat

Path C:\Users\Admin\AppData\Local\Temp\Taskdl.bat
Size 4KB
SHA256 64e7b1e0829a8180a143212748f4a1950cf4b2e433b6921395d33af72090dce0
MD5 cba4e72b76bd3ce5a2ebe1bf68fe3eae
SHA1 fd22c9ee3af810241c8583a80448f1f1d06d49a3
SHA512 9becd6d4d9ee5082d904e40e306cd285467a1659ac5eef9c9473f904a6af9df2a08b2bd4f0c9434e784b00d83c516dc34f6e50779b8d0ace5276cfed0854a91d
SSDEEP 96:/9Gl99Gl99Gl99Gl99Gl9rT93l99Gl99Gl99Gl9Veb9VlArT9379Gl99Gl29G79t:/8383838383rT53838383VebzmrT578g
MD5 SHA1 SHA512 SSDEEP

Submit Download

Taskdl.bat

Path C:\Users\Admin\AppData\Local\Temp\Taskdl.bat
Size 519B
SHA256 b2cf1c83480bb2e69599e063be75ef8188b20c82a03998098d13d42c11502d21
MD5 03f0ef4961ee3f5ebc91e222ad5c3a55
SHA1 130947f0716f672e1c0577f60471dfbd9d1f3435
SHA512 641784c8422a15360449ae9d79722e4d6d5752ef8db0a6cd8e1d71e78c5994dc9e790f5e875a7314be603feb42badc587bf79e8f682aa94b2335443ea8592671
MD5 SHA1 SHA512

Submit Download

Taskdl.bat

Path C:\Users\Admin\AppData\Local\Temp\Taskdl.bat
Size 692B
SHA256 b370b54e95376f4b6df27592bc23343c82ebbfad3d52e71a38a2aac504bda04c
MD5 6989502044e4a9fca67e9ded25de9956
SHA1 9a8d099caad939d32599530b27f7db641cbdb8da
SHA512 9f0e6d59d9adc531f5c162b964205e0dd63c6a956291af48d24e6b8988a940b6f2cc7644a9163277e6383a6d9f8ddb00c9687d73426ea776c691e73f66e95a5e
MD5 SHA1 SHA512

Submit Download

Taskdl.bat

Path C:\Users\Admin\AppData\Local\Temp\Taskdl.bat
Size 800B
SHA256 399adfef7fee19fb39563b04ed864e2cadb7151912af0bd485b9d042d95ba5e4
MD5 6be2a551c3de6c22992d28cd8ee588c0
SHA1 31aba40febff5dc3922aeeb326cd33ee5826ee42
SHA512 ee277cab71f860d24a67f5104b2abefc4aadf8b7bd1ff4671cbb60566b869b3b72c91b6cd7bd8e2c9b4eb1283d31d0661c3fad842fed396f78999e5535509f04
MD5 SHA1 SHA512

Submit Download

Taskdl.bat

Path C:\Users\Admin\AppData\Local\Temp\Taskdl.bat
Size 865B
SHA256 7699fff0e361a55cce19ca7922fae4f70eb6ca56b770223fab5d1fd936b0a184
MD5 5dfd819273a34eeb1a213e66dd8308a7
SHA1 65291936bcbe05742a6bc15d989d5e3acff59998
SHA512 d19cf3e05df7d5d1f360d20a47e2658d03067cffce1b767bf2e430ebba5f49bcdb37e9c098c195c919682bf90b5a54c508dad587bff3f4c1c73ac6065b019913
MD5 SHA1 SHA512

Submit Download

Taskdl.bat

Path C:\Users\Admin\AppData\Local\Temp\Taskdl.bat
Size 1KB
SHA256 e37b035ba3bf569192cee488f57b1bc672c94d6003620fe17249acfbfd4cce11
MD5 58e907ee6a64a54663adac97ebe39ba6
SHA1 0f1aac6bc3dd7d1deaee982c4e3eac68b5e765af
SHA512 868c6070cc910d7f9f66faf2000af86494071724cbeddf96f7a4db3239b68501d1fcf2fbd1690b6692ff2d27098557893d6bcc58256643e4e90e64ef512df4f3
MD5 SHA1 SHA512

Submit Download

Taskdl.bat

Path C:\Users\Admin\AppData\Local\Temp\Taskdl.bat
Size 173B
SHA256 3c656f47268598c5bbe3ee4661b4f8c7dc09420cf393a6e417541db3c6020205
MD5 0c998e3681eb9f67fbacda38281c5fa7
SHA1 bd3e89780f374c54c5dfbe3fab83a926ca5803de
SHA512 11e3fd1d141bd23a2b0f17665f0f57e5a606fdd82555a7bd88cd533863ce4269d8395f8963d1cdfde93efbb0817486db48c3b593f8de35e150e2395daadb762e
MD5 SHA1 SHA512

Submit Download

Taskse.exe

Path C:\Users\Admin\AppData\Local\Temp\Taskse.exe
Size 13KB
SHA256 f751e41449dca4ad3d10ca28c07aa608465160a51865bea69a2974782d681857
MD5 3098ebe83b5b5e6bc0e73d3a3f0762f0
SHA1 18edcaf1de17688fd1bb7ee192c0e0d000ffe705
SHA512 82ebe4fe80d0e21da5c788a9b5ce88097518bd46d6c5ad2fd200a0af375dc979269a3eb11e1c833f9b67acfe5a13eea79c3181b6924f5ed0953c9ada95732f15
SSDEEP 384:2NmiFjafajJ8ojtHNR7H+Ok6pZXhqY7R7H+Ok6pZXhqY+:2N55FrjttR5kuRqY7R5kuRqY+
MD5 SHA1 SHA512 SSDEEP

Submit Download

Taskse.exe

Path C:\Users\Admin\AppData\Local\Temp\Taskse.exe
Size 20KB
SHA256 d705186e4de0aae2f588c744b8730d2d6a855d2f0a70ad25796c772dcc90edc5
MD5 2b53a46ae02fce67bce51e7c8e038090
SHA1 eed125727ba662809b429c1daf51537bcbe99282
SHA512 b36e37c3173e82620c03a173b2f08d3632cfe548c68447e239ada09cf278338632f684e2a6b37a25b290bb9fc8e5187c787cec4dd50b020f9b9c6e4200f19619
SSDEEP 384:2NmiFjafajJ8ojtHNR7H+Ok6pZXhqY7R7H+Ok6pZXhqY7R7H+Ok6IyZ5AfEDHu5o:2N55FrjttR5kuRqY7R5kuRqY7R5kQ/rT
MD5 SHA1 SHA512 SSDEEP

Submit Download

Taskse.exe

Path C:\Users\Admin\AppData\Local\Temp\Taskse.exe
Size 22KB
SHA256 5a7d7e094c380508c47460313d7af3447983c604042dffb0c0a246dfbcf79f90
MD5 2276398c7dd4ee1066aee28daf25d55d
SHA1 3c85b0f3aff2025a283e65076b44e4798d054d87
SHA512 f0e9ba4dce38383125cead874fdbbce10d95632591ccb1105ff4dbc3eb65c79668fe45037ddcf6a1e7233523bdf2a60abc53b3eb727369308eb7fc8545d94157
SSDEEP 384:2NmiFjafajJ8ojtHNR7H+Ok6pZXhqY7R7H+Ok6pZXhqY7R7H+Ok6IyZ5AfEDHu56:2N55FrjttR5kuRqY7R5kuRqY7R5kQ/rb
MD5 SHA1 SHA512 SSDEEP

Submit Download

Taskse.exe

Path C:\Users\Admin\AppData\Local\Temp\Taskse.exe
Size 4KB
SHA256 8e9ad1b933e2f85ea8de0fe48ed4d04073926a6faa76b936dbbea6083334fe52
MD5 8c8ff6a844edd52318e043a43034dee7
SHA1 57ee0ba89c5ba879ccda08c8b466d0151d99dc13
SHA512 e9130a9030f55b4b6ae9b33f1458f644d5192d9a9fb0b817b83635dd317cd77912f716e7faf836c97ce72d8d42e05ec85ea582f9a09c04cbe02cdcf857937f1b
SSDEEP 96:0f7ZpjV4tsuHIfdSuaF9a0F4omFpXZdKdRSFXYuKoj3ZEdiTNUr+9ou2P:cVpjmtscIFSuafae41DdWUuzojscUq+F
MD5 SHA1 SHA512 SSDEEP

Submit Download

Twain_20.cmd

Path C:\Users\Admin\AppData\Local\Temp\Twain_20.cmd
Size 197B
SHA256 7be75820d337a48c320e260fb71f40a5a0cbfa5c8c225bec5ff23c1cc15566f7
MD5 c7f2bc79dba9b078638f4692947066b0
SHA1 a42bea02d22367788cb2dc77f68ea754c244a50c
SHA512 33f2a1c3708d4b3b353122105931ddb34dc4be146ffa73b24dee1eaaeb60f0eed2c3bbf4ad84d648f6408c8b9e0cbbbc421864514c1e057b0cea2c12b2c5d296
MD5 SHA1 SHA512

Submit Download

Twain_20.cmd

Path C:\Users\Admin\AppData\Local\Temp\Twain_20.cmd
Size 11B
SHA256 c134b2f85415ba5cfce3e3fe4745688335745a9bb22152ac8f5c77f190d8aee3
MD5 9905e5a33c6edd8eb5f59780afbf74de
SHA1 64b2cd0186ff6fe05072ee88e2bb54476023772e
SHA512 e10711d0fb09db27192e9af05ae45b83cf3882d98e904a7f1f969cf24c2f9626f70f35d76f57477fe9c64a58bc74100410740e9d506d4e72d3e2900d6277816e
MD5 SHA1 SHA512

Submit Download

Twain_20.cmd

Path C:\Users\Admin\AppData\Local\Temp\Twain_20.cmd
Size 158B
SHA256 28d651bd0e01d8ee66b46b064b05841cf33e44f3c55ee8b0612f5a812bf0de43
MD5 ad0010095a82da61b486dbe70cd90767
SHA1 67d5a65f8cee8409dfcec2da99d290a2730cd662
SHA512 93a5f5c2f71a00ce760f1efe89280e259b3f75f1d04e3a1708d683c0b9a619fb5ac577e0d9f59c3b767c3b45323e3af9450362624526705766bf77a94b4aa827
MD5 SHA1 SHA512

Submit Download

Twain_20.dll

Path C:\Users\Admin\AppData\Local\Temp\Twain_20.dll
Size 106KB
SHA256 6ca11c8b6442db97c02f3b0f73db61f58c96d52e8a880e33abee5b10807d993f
MD5 8b6a377f9a67d5482a8eba5708f45bb2
SHA1 7197436525e568606850ee5e033c43aea1c3bc91
SHA512 644e51798399168530b05e629b414dd80cac678bd3c8d4a5d164f55736a2b2fd380d3ca4640f7a034c8f043c06b1527b473e2d17da088d5e97de6ea04120dd72
SSDEEP 3072:v7DhdC6kzWypvaQ0FxyNTBfqMXERseQF8:vBlkZvaF4NTBSAesPF8
MD5 SHA1 SHA512 SSDEEP

Submit Download

windowswimn32.bat

Path C:\Users\Admin\AppData\Local\Temp\windowswimn32.bat
Size 44B
SHA256 3ade659fdae17c11c3f42b712f94045691fbd0b413428b73e1de8fe699e74615
MD5 ea260c435f9eb83e2b5041e734ff3598
SHA1 ca70d64367cbdffbbf24e82baff4048119203a2e
SHA512 548624cc523aeb4136376f792d23b3f2aee4a676362f8a0dd0e8161f0df87ab926b82f67fc174eb5d9473c23f49e6ca962bc84479967f7e624250d94efa66876
MD5 SHA1 SHA512

Submit Download

windowswimn32.bat

Path C:\Users\Admin\AppData\Local\Temp\windowswimn32.bat
Size 22B
SHA256 138b48a413afa60daa506090fa4332d913a1f9d895b6c289c36dd7db00019d64
MD5 fe669e0a3a56961fba38ef9b7f7d01dd
SHA1 338b6f4a3ec71587d53aec450ca5448928f966a1
SHA512 ff0bc50cef59421253578172602a56f9f9b3a8988a16576eaf8a004792d330c708dbed95f5f4074fb2eec36d7df7f4a0392c88420d2b0678cd907056a23cd41b
MD5 SHA1 SHA512

Submit Download

windowswimn32.bat

Path C:\Users\Admin\AppData\Local\Temp\windowswimn32.bat
Size 49B
SHA256 a06f170d4f92bf290e38b0ce1c05bb59c95de2797b1a5253b949ad7e1be9818b
MD5 cfb046d3c9513b92c1b287da26f97c28
SHA1 ea8208c4dad826b7fdb3b5b728863a95e86d4383
SHA512 dbeeea4d284f59e1455a5426334caa02458e88833aeece9817c51be616697ca4c399b2a9d0e8e44bf4a5ee63d0b37c0aed68c01f1748fa5a23ed6d2af62b3340
MD5 SHA1 SHA512

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 4KB
SHA256 8cfa44aff855ee951f51b4ae2482eb53b86789df4e1ff0a2346a87a248e0ecb7
MD5 9f182d7a8d0d47bd754141fbd6f352c8
SHA1 5939bab760a020485799788676b223d97d4fae42
SHA512 3aad839f2ac2e3690e98e519063ea5b04589a5753fdae523854fa01cd14db1521b4b712fd98888ed67b8fc0a062907e699fa7045fbce1136e5dd4a4a5043d286
SSDEEP 96:0AYiSm8iSqOdiS3RzopDRHEX307S3RzopeRHEPS30nSdWnSwix5Sm6SCS3Rzo6Rj:0AXSmzSqrS3RzoZRi3iS3RzogRX3USQc
MD5 SHA1 SHA512 SSDEEP

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 6KB
SHA256 7552d71c831bd8736a09ba89cdbc03766a86d38653b8606b87426188391e797d
MD5 92d5f584d83d142d4f3c470932f6e2fc
SHA1 60c489e78688c7c2925fec0f17e69221903009e6
SHA512 71349b77b6d31025807a02c4d33c10907b37de40cd0c2dd5109eda8cd8429680575e42ef48d10f31c76d34a713793487057740effbf42cab4af3741ae0232cb0
SSDEEP 192:0AXSmzSqrS3RzoZRi3iS3RzogRX3USQSwix5Sm6SCS3Rzo6RTS3Rzo6R9xcSmIS9:0+SmzSgSySCSQSwi7Sm6SCS5SjiSmIS9
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/10668-1251-0x00007FF903C30000-0x00007FF903E25000-memory.dmp

Download

memory/10844-1191-0x00007FF903C30000-0x00007FF903E25000-memory.dmp

Download

memory/15992-1183-0x0000000000050000-0x00000000000A2000-memory.dmp

Download